aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorCong Wang <xiyou.wangcong@gmail.com>2018-08-07 15:41:38 -0400
committerDavid S. Miller <davem@davemloft.net>2018-08-07 18:54:00 -0400
commit0dcb82254d65f72333aa50ad626d1e9665ad093b (patch)
tree0624bb5c365884b956d4abaf79d50e87a1406762
parent61ef4b07fcdc30535889990cf4229766502561cf (diff)
llc: use refcount_inc_not_zero() for llc_sap_find()
llc_sap_put() decreases the refcnt before deleting sap from the global list. Therefore, there is a chance llc_sap_find() could find a sap with zero refcnt in this global list. Close this race condition by checking if refcnt is zero or not in llc_sap_find(), if it is zero then it is being removed so we can just treat it as gone. Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--include/net/llc.h5
-rw-r--r--net/llc/llc_core.c4
2 files changed, 7 insertions, 2 deletions
diff --git a/include/net/llc.h b/include/net/llc.h
index dc35f25eb679..890a87318014 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
116 refcount_inc(&sap->refcnt); 116 refcount_inc(&sap->refcnt);
117} 117}
118 118
119static inline bool llc_sap_hold_safe(struct llc_sap *sap)
120{
121 return refcount_inc_not_zero(&sap->refcnt);
122}
123
119void llc_sap_close(struct llc_sap *sap); 124void llc_sap_close(struct llc_sap *sap);
120 125
121static inline void llc_sap_put(struct llc_sap *sap) 126static inline void llc_sap_put(struct llc_sap *sap)
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 89041260784c..260b3dc1b4a2 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
73 73
74 rcu_read_lock_bh(); 74 rcu_read_lock_bh();
75 sap = __llc_sap_find(sap_value); 75 sap = __llc_sap_find(sap_value);
76 if (sap) 76 if (!sap || !llc_sap_hold_safe(sap))
77 llc_sap_hold(sap); 77 sap = NULL;
78 rcu_read_unlock_bh(); 78 rcu_read_unlock_bh();
79 return sap; 79 return sap;
80} 80}