Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26b41099 authored by tsutomu.owa@toshiba.co.jp's avatar tsutomu.owa@toshiba.co.jp Committed by David Teigland
Browse files

DLM: fix NULL pointer dereference in send_to_sock() 



The writequeue and writequeue_lock member of othercon was not initialized.
If lowcomms_state_change() is called from network layer, othercon->swork
may be scheduled. In this case, send_to_sock() will generate a NULL pointer
reference. We avoid this problem by correctly initializing writequeue and
writequeue_lock member of othercon.

Signed-off-by: default avatarTadashi Miyauchi <miyauchi@toshiba-tops.co.jp>
Signed-off-by: default avatarTsutomu Owa <tsutomu.owa@toshiba.co.jp>
Signed-off-by: default avatarDavid Teigland <teigland@redhat.com>
parent 0aa18464

fs/dlm/lowcomms.c

+4 −0
Original line number Diff line number Diff line
@@ -802,6 +802,8 @@ static int tcp_accept_from_sock(struct connection *con) 
			othercon->nodeid = nodeid;

			othercon->rx_action = receive_from_sock;

			mutex_init(&othercon->sock_mutex);

			INIT_LIST_HEAD(&othercon->writequeue);

			spin_lock_init(&othercon->writequeue_lock);

			INIT_WORK(&othercon->swork, process_send_sockets);

			INIT_WORK(&othercon->rwork, process_recv_sockets);

			set_bit(CF_IS_OTHERCON, &othercon->flags);
@@ -920,6 +922,8 @@ static int sctp_accept_from_sock(struct connection *con) 
			othercon->nodeid = nodeid;

			othercon->rx_action = receive_from_sock;

			mutex_init(&othercon->sock_mutex);

			INIT_LIST_HEAD(&othercon->writequeue);

			spin_lock_init(&othercon->writequeue_lock);

			INIT_WORK(&othercon->swork, process_send_sockets);

			INIT_WORK(&othercon->rwork, process_recv_sockets);

			set_bit(CF_IS_OTHERCON, &othercon->flags);