* [Patch net] llc: use refcount_inc_not_zero() for llc_sap_find()
@ 2018-08-07 19:41 Cong Wang
2018-08-07 22:54 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Cong Wang @ 2018-08-07 19:41 UTC (permalink / raw)
To: netdev; +Cc: Cong Wang
llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.
Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.
Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
include/net/llc.h | 5 +++++
net/llc/llc_core.c | 4 ++--
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/include/net/llc.h b/include/net/llc.h
index dc35f25eb679..890a87318014 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
refcount_inc(&sap->refcnt);
}
+static inline bool llc_sap_hold_safe(struct llc_sap *sap)
+{
+ return refcount_inc_not_zero(&sap->refcnt);
+}
+
void llc_sap_close(struct llc_sap *sap);
static inline void llc_sap_put(struct llc_sap *sap)
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 89041260784c..260b3dc1b4a2 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
rcu_read_lock_bh();
sap = __llc_sap_find(sap_value);
- if (sap)
- llc_sap_hold(sap);
+ if (!sap || !llc_sap_hold_safe(sap))
+ sap = NULL;
rcu_read_unlock_bh();
return sap;
}
--
2.14.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Patch net] llc: use refcount_inc_not_zero() for llc_sap_find()
2018-08-07 19:41 [Patch net] llc: use refcount_inc_not_zero() for llc_sap_find() Cong Wang
@ 2018-08-07 22:54 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2018-08-07 22:54 UTC (permalink / raw)
To: xiyou.wangcong; +Cc: netdev
From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Tue, 7 Aug 2018 12:41:38 -0700
> llc_sap_put() decreases the refcnt before deleting sap
> from the global list. Therefore, there is a chance
> llc_sap_find() could find a sap with zero refcnt
> in this global list.
>
> Close this race condition by checking if refcnt is zero
> or not in llc_sap_find(), if it is zero then it is being
> removed so we can just treat it as gone.
>
> Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-08-08 1:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-07 19:41 [Patch net] llc: use refcount_inc_not_zero() for llc_sap_find() Cong Wang
2018-08-07 22:54 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.