diff options
| author | Eric Dumazet <edumazet@google.com> | 2022-02-05 01:42:35 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-02-05 18:22:44 +0300 |
| commit | e3ececfe668facd87d920b608349a32607060e66 (patch) | |
| tree | 99cee105c8bf97b641e5d1121e8a778c0c5149d3 /include/linux/ref_tracker.h | |
| parent | cc3063502e0893c491ff83b61f43d402c144857d (diff) | |
| download | linux-e3ececfe668facd87d920b608349a32607060e66.tar.xz | |
ref_tracker: implement use-after-free detection
Whenever ref_tracker_dir_init() is called, mark the struct ref_tracker_dir
as dead.
Test the dead status from ref_tracker_alloc() and ref_tracker_free()
This should detect buggy dev_put()/dev_hold() happening too late
in netdevice dismantle process.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/ref_tracker.h')
| -rw-r--r-- | include/linux/ref_tracker.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/ref_tracker.h b/include/linux/ref_tracker.h index 60f3453be23e..a443abda937d 100644 --- a/include/linux/ref_tracker.h +++ b/include/linux/ref_tracker.h @@ -13,6 +13,7 @@ struct ref_tracker_dir { spinlock_t lock; unsigned int quarantine_avail; refcount_t untracked; + bool dead; struct list_head list; /* List of active trackers */ struct list_head quarantine; /* List of dead trackers */ #endif @@ -26,6 +27,7 @@ static inline void ref_tracker_dir_init(struct ref_tracker_dir *dir, INIT_LIST_HEAD(&dir->quarantine); spin_lock_init(&dir->lock); dir->quarantine_avail = quarantine_count; + dir->dead = false; refcount_set(&dir->untracked, 1); stack_depot_init(); } |