diff options
author | Cong Wang <xiyou.wangcong@gmail.com> | 2018-08-07 22:41:38 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-08-28 08:21:31 +0300 |
commit | 71e6f3f1c911f786c31fdb3be6ca2fc807d3aefa (patch) | |
tree | eb6892d6ace0c6e10fe711d6b67813a4b8f60824 /net/llc | |
parent | 719710e960a5f6bfa0852ffc1af9ad6bb125511d (diff) | |
download | linux-71e6f3f1c911f786c31fdb3be6ca2fc807d3aefa.tar.xz |
llc: use refcount_inc_not_zero() for llc_sap_find()
[ Upstream commit 0dcb82254d65f72333aa50ad626d1e9665ad093b ]
llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.
Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.
Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/llc')
-rw-r--r-- | net/llc/llc_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c index 842851cef698..e896a2c53b12 100644 --- a/net/llc/llc_core.c +++ b/net/llc/llc_core.c @@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value) rcu_read_lock_bh(); sap = __llc_sap_find(sap_value); - if (sap) - llc_sap_hold(sap); + if (!sap || !llc_sap_hold_safe(sap)) + sap = NULL; rcu_read_unlock_bh(); return sap; } |