From eb8df9a0466078f083822e5ef2fb16713c94d25c Mon Sep 17 00:00:00 2001 From: Wissam Shoukair Date: Wed, 12 Aug 2015 12:28:58 +0300 Subject: [ipoib] Fix a race when chain-loading undionly.kpxe in IPoIB The Infiniband link status change callback ipoib_link_state_changed() may be called while the IPoIB device is closed, in which case there will not be an IPoIB queue pair to be joined to the IPv4 broadcast group. This leads to NULL pointer dereferences in ib_mcast_attach() and ib_mcast_detach(). Fix by not attempting to join (or leave) the broadcast group unless we actually have an IPoIB queue pair. Signed-off-by: Wissam Shoukair Modified-by: Michael Brown Signed-off-by: Michael Brown --- src/net/infiniband/ib_mcast.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src/net/infiniband') diff --git a/src/net/infiniband/ib_mcast.c b/src/net/infiniband/ib_mcast.c index 02369269f..fc4ff7f0a 100644 --- a/src/net/infiniband/ib_mcast.c +++ b/src/net/infiniband/ib_mcast.c @@ -150,6 +150,9 @@ int ib_mcast_join ( struct ib_device *ibdev, struct ib_queue_pair *qp, DBGC ( ibdev, "IBDEV %p QPN %lx joining " IB_GID_FMT "\n", ibdev, qp->qpn, IB_GID_ARGS ( gid ) ); + /* Sanity check */ + assert ( qp != NULL ); + /* Initialise structure */ membership->qp = qp; memcpy ( &membership->gid, gid, sizeof ( membership->gid ) ); @@ -199,6 +202,9 @@ void ib_mcast_leave ( struct ib_device *ibdev, struct ib_queue_pair *qp, DBGC ( ibdev, "IBDEV %p QPN %lx leaving " IB_GID_FMT "\n", ibdev, qp->qpn, IB_GID_ARGS ( gid ) ); + /* Sanity check */ + assert ( qp != NULL ); + /* Detach from multicast GID */ ib_mcast_detach ( ibdev, qp, &membership->gid ); -- cgit v1.2.3-55-g7522