hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

llc: use refcount_inc_not_zero() for llc_sap_find() 

llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.

Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.

Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Cong Wang 2018-08-07 12:41:38 -07:00 committed by David S. Miller
parent 61ef4b07fc
commit 0dcb82254d
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/net/llc.h
View File

@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
refcount_inc(&sap->refcnt); refcount_inc(&sap->refcnt);
} }
static inline bool llc_sap_hold_safe(struct llc_sap *sap)
{
return refcount_inc_not_zero(&sap->refcnt);
}
void llc_sap_close(struct llc_sap *sap); void llc_sap_close(struct llc_sap *sap);
static inline void llc_sap_put(struct llc_sap *sap) static inline void llc_sap_put(struct llc_sap *sap)

4
net/llc/llc_core.c
View File

@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
rcu_read_lock_bh(); rcu_read_lock_bh();
sap = __llc_sap_find(sap_value); sap = __llc_sap_find(sap_value);
if (sap) if (!sap || !llc_sap_hold_safe(sap))
llc_sap_hold(sap); sap = NULL;
rcu_read_unlock_bh(); rcu_read_unlock_bh();
return sap; return sap;
} }