Jiri Pirko 57e5956319 team: fix possible null pointer dereference in team_handle_frame ... Currently following race is possible in team: CPU0 CPU1 team_port_del team_upper_dev_unlink priv_flags &= ~IFF_TEAM_PORT team_handle_frame team_port_get_rcu team_port_exists priv_flags & IFF_TEAM_PORT == 0 return NULL (instead of port got from rx_handler_data) netdev_rx_handler_unregister The thing is that the flag is removed before rx_handler is unregistered. If team_handle_frame is called in between, team_port_exists returns 0 and team_port_get_rcu will return NULL. So do not check the flag here. It is guaranteed by netdev_rx_handler_unregister that team_handle_frame will always see valid rx_handler_data pointer. Signed-off-by: Jiri Pirko <jiri@resnulli.us> Fixes: 3d249d4ca7 ("net: introduce ethernet teaming device") Signed-off-by: David S. Miller <davem@davemloft.net>		2015-02-23 15:30:28 -05:00
..
Kconfig	team: introduce random mode	2013-03-06 14:55:20 -05:00
Makefile	team: introduce random mode	2013-03-06 14:55:20 -05:00
team_mode_activebackup.c	team: ab: set active port option as changed when port is leaving	2013-02-04 14:55:45 -05:00
team_mode_broadcast.c	team: introduce two default team_modeop functions and use them in modes	2013-03-06 14:55:20 -05:00
team_mode_loadbalance.c	net: filter: split 'struct sk_filter' into socket and bpf parts	2014-08-02 15:03:58 -07:00
team_mode_random.c	random32: add prandom_u32_max and convert open coded users	2014-01-21 23:17:20 -08:00
team_mode_roundrobin.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-06-19 16:49:39 -07:00
team.c	team: fix possible null pointer dereference in team_handle_frame	2015-02-23 15:30:28 -05:00