From: Tuong Lien <tuong.t.l...@dektech.com.au> Date: Thu, 11 Jun 2020 17:08:08 +0700
> When a bearer is enabled, we create a 'tipc_discoverer' object to store > the bearer related data along with a timer and a preformatted discovery > message buffer for later probing... However, this is only carried after > the bearer was set 'up', that left a race condition resulting in kernel > panic. > > It occurs when a discovery message from a peer node is received and > processed in bottom half (since the bearer is 'up' already) just before > the discoverer object is created but is now accessed in order to update > the preformatted buffer (with a new trial address, ...) so leads to the > NULL pointer dereference. > > We solve the problem by simply moving the bearer 'up' setting to later, > so make sure everything is ready prior to any message receiving. > > Acked-by: Jon Maloy <jma...@redhat.com> > Signed-off-by: Tuong Lien <tuong.t.l...@dektech.com.au> Applied, thanks.
