From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com,
Cong Wang <xiyou.wangcong@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.17 03/42] llc: use refcount_inc_not_zero() for llc_sap_find()
Date: Tue, 21 Aug 2018 08:20:35 +0200 [thread overview]
Message-ID: <20180821055017.740649195@linuxfoundation.org> (raw)
In-Reply-To: <20180821055017.596264829@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 0dcb82254d65f72333aa50ad626d1e9665ad093b ]
llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.
Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.
Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/llc.h | 5 +++++
net/llc/llc_core.c | 4 ++--
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct l
refcount_inc(&sap->refcnt);
}
+static inline bool llc_sap_hold_safe(struct llc_sap *sap)
+{
+ return refcount_inc_not_zero(&sap->refcnt);
+}
+
void llc_sap_close(struct llc_sap *sap);
static inline void llc_sap_put(struct llc_sap *sap)
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned ch
rcu_read_lock_bh();
sap = __llc_sap_find(sap_value);
- if (sap)
- llc_sap_hold(sap);
+ if (!sap || !llc_sap_hold_safe(sap))
+ sap = NULL;
rcu_read_unlock_bh();
return sap;
}
next prev parent reply other threads:[~2018-08-21 6:24 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-21 6:20 [PATCH 4.17 00/42] 4.17.18-stable review Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 01/42] dccp: fix undefined behavior with cwnd shift in ccid2_cwnd_restart() Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 02/42] l2tp: use sk_dst_check() to avoid race on sk->sk_dst_cache Greg Kroah-Hartman
2018-08-21 6:20 ` Greg Kroah-Hartman [this message]
2018-08-21 6:20 ` [PATCH 4.17 04/42] net_sched: fix NULL pointer dereference when delete tcindex filter Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 05/42] vsock: split dwork to avoid reinitializations Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 06/42] net_sched: Fix missing res info when create new tc_index filter Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 07/42] vhost: reset metadata cache when initializing new IOTLB Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 08/42] mlxsw: core_acl_flex_actions: Return error for conflicting actions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 09/42] net: aquantia: Fix IFF_ALLMULTI flag functionality Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 10/42] ip6_tunnel: use the right value for ipv4 min mtu check in ip6_tnl_xmit Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 11/42] mlxsw: core_acl_flex_actions: Remove redundant resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 12/42] mlxsw: core_acl_flex_actions: Remove redundant counter destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 13/42] mlxsw: core_acl_flex_actions: Remove redundant mirror resource destruction Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 14/42] net/mlx5e: Properly check if hairpin is possible between two functions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 15/42] r8169: dont use MSI-X on RTL8168g Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 16/42] rxrpc: Fix the keepalive generator [ver #2] Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 17/42] ALSA: hda - Sleep for 10ms after entering D3 on Conexant codecs Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 18/42] ALSA: hda - Turn CX8200 into D3 as well upon reboot Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 19/42] ALSA: vx222: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 20/42] ALSA: virmidi: Fix too long output trigger loop Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 21/42] ALSA: cs5535audio: Fix invalid endian conversion Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 22/42] ALSA: hda: Correct Asrock B85M-ITX power_save blacklist entry Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 23/42] ALSA: memalloc: Dont exceed over the requested size Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 24/42] ALSA: vxpocket: Fix invalid endian conversions Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 25/42] ALSA: seq: Fix poll() error return Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 26/42] USB: serial: sierra: fix potential deadlock at close Greg Kroah-Hartman
2018-08-21 6:20 ` [PATCH 4.17 27/42] USB: serial: pl2303: add a new device id for ATEN Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 28/42] USB: option: add support for DW5821e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 29/42] ACPI / PM: save NVS memory for ASUS 1025C laptop Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 30/42] tty: serial: 8250: Revert NXP SC16C2552 workaround Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 31/42] serial: 8250_exar: Read INT0 from slave device, too Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 32/42] serial: 8250_dw: always set baud rate in dw8250_set_termios Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 33/42] serial: 8250_dw: Add ACPI support for uart on Broadcom SoC Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 34/42] misc: sram: fix resource leaks in probe error path Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 35/42] Bluetooth: avoid killing an already killed socket Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 36/42] isdn: Disable IIOCDBGVAR Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 37/42] net: sock_diag: Fix spectre v1 gadget in __sock_diag_cmd() Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 38/42] r8169: dont use MSI-X on RTL8106e Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 39/42] ip_vti: fix a null pointer deferrence when create vti fallback tunnel Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 40/42] cls_matchall: fix tcf_unbind_filter missing Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 41/42] net: ethernet: mvneta: Fix napi structure mixup on armada 3700 Greg Kroah-Hartman
2018-08-21 6:21 ` [PATCH 4.17 42/42] net: mvneta: fix mvneta_config_rss " Greg Kroah-Hartman
2018-08-21 14:58 ` [PATCH 4.17 00/42] 4.17.18-stable review Guenter Roeck
2018-08-21 18:04 ` Naresh Kamboju
2018-08-21 19:44 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180821055017.740649195@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com \
--cc=xiyou.wangcong@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).