d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a panic caused by doing "ifconfig -am" while a lagg is being destroyed.

Browse Source 
The thread that is destroying the lagg has already set sc->sc_psc=NULL when
the "ifconfig -am" thread gets to lacp_req().  It tries to dereference
sc->sc_psc and panics.  The solution is for lacp_req() to check the value of
sc->sc_psc.  If NULL, harmlessly return an lacp_opreq structure full of
zeros.  Full details in GNATS.

PR:		kern/189003
Reviewed by:	timeout on freebsd-net@
MFC after:	3 weeks
Sponsored by:	Spectra Logic Corporation
This commit is contained in:
Alan Somers 2014-05-02 16:24:09 +00:00
parent cd85ba9385
commit f544a74870
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=265232
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/net/ieee8023ad_lacp.c
View File

@ -590,10 +590,20 @@ lacp_req(struct lagg_softc *sc, caddr_t data)
{ {
struct lacp_opreq *req = (struct lacp_opreq *)data; struct lacp_opreq *req = (struct lacp_opreq *)data;
struct lacp_softc *lsc = LACP_SOFTC(sc); struct lacp_softc *lsc = LACP_SOFTC(sc);
struct lacp_aggregator *la = lsc->lsc_active_aggregator; struct lacp_aggregator *la;
LACP_LOCK(lsc);
bzero(req, sizeof(struct lacp_opreq)); bzero(req, sizeof(struct lacp_opreq));
/*
* If the LACP softc is NULL, return with the opreq structure full of
* zeros. It is normal for the softc to be NULL while the lagg is
* being destroyed.
*/
if (NULL == lsc)
return;
la = lsc->lsc_active_aggregator;
LACP_LOCK(lsc);
if (la != NULL) { if (la != NULL) {
req->actor_prio = ntohs(la->la_actor.lip_systemid.lsi_prio); req->actor_prio = ntohs(la->la_actor.lip_systemid.lsi_prio);
memcpy(&req->actor_mac, &la->la_actor.lip_systemid.lsi_mac, memcpy(&req->actor_mac, &la->la_actor.lip_systemid.lsi_mac,