diff options
author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-08-07 15:41:38 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-08-07 18:54:00 -0400 |
commit | 0dcb82254d65f72333aa50ad626d1e9665ad093b (patch) | |
tree | 0624bb5c365884b956d4abaf79d50e87a1406762 | |
parent | 61ef4b07fcdc30535889990cf4229766502561cf (diff) |
llc: use refcount_inc_not_zero() for llc_sap_find()
llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.
Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.
Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | include/net/llc.h | 5 | ||||
-rw-r--r-- | net/llc/llc_core.c | 4 |
2 files changed, 7 insertions, 2 deletions
diff --git a/include/net/llc.h b/include/net/llc.h index dc35f25eb679..890a87318014 100644 --- a/include/net/llc.h +++ b/include/net/llc.h | |||
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap) | |||
116 | refcount_inc(&sap->refcnt); | 116 | refcount_inc(&sap->refcnt); |
117 | } | 117 | } |
118 | 118 | ||
119 | static inline bool llc_sap_hold_safe(struct llc_sap *sap) | ||
120 | { | ||
121 | return refcount_inc_not_zero(&sap->refcnt); | ||
122 | } | ||
123 | |||
119 | void llc_sap_close(struct llc_sap *sap); | 124 | void llc_sap_close(struct llc_sap *sap); |
120 | 125 | ||
121 | static inline void llc_sap_put(struct llc_sap *sap) | 126 | static inline void llc_sap_put(struct llc_sap *sap) |
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 89041260784c..260b3dc1b4a2 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c | |||
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value) | |||
73 | 73 | ||
74 | rcu_read_lock_bh(); | 74 | rcu_read_lock_bh(); |
75 | sap = __llc_sap_find(sap_value); | 75 | sap = __llc_sap_find(sap_value); |
76 | if (sap) | 76 | if (!sap || !llc_sap_hold_safe(sap)) |
77 | llc_sap_hold(sap); | 77 | sap = NULL; |
78 | rcu_read_unlock_bh(); | 78 | rcu_read_unlock_bh(); |
79 | return sap; | 79 | return sap; |
80 | } | 80 | } |