summaryrefslogtreecommitdiff
path: root/tools/bpf
diff options
context:
space:
mode:
authorDuoming Zhou <duoming@zju.edu.cn>2022-04-05 16:22:06 +0300
committerJakub Kicinski <kuba@kernel.org>2022-04-07 09:00:16 +0300
commitec4eb8a86ade4d22633e1da2a7d85a846b7d1798 (patch)
tree83177045d62c3294479a81517c3a3ca68636b7a2 /tools/bpf
parent8e9d0d7a76c556e8b73289555950917db13d2077 (diff)
downloadlinux-ec4eb8a86ade4d22633e1da2a7d85a846b7d1798.tar.xz
drivers: net: slip: fix NPD bug in sl_tx_timeout()
When a slip driver is detaching, the slip_close() will act to cleanup necessary resources and sl->tty is set to NULL in slip_close(). Meanwhile, the packet we transmit is blocked, sl_tx_timeout() will be called. Although slip_close() and sl_tx_timeout() use sl->lock to synchronize, we don`t judge whether sl->tty equals to NULL in sl_tx_timeout() and the null pointer dereference bug will happen. (Thread 1) | (Thread 2) | slip_close() | spin_lock_bh(&sl->lock) | ... ... | sl->tty = NULL //(1) sl_tx_timeout() | spin_unlock_bh(&sl->lock) spin_lock(&sl->lock); | ... | ... tty_chars_in_buffer(sl->tty)| if (tty->ops->..) //(2) | ... | synchronize_rcu() We set NULL to sl->tty in position (1) and dereference sl->tty in position (2). This patch adds check in sl_tx_timeout(). If sl->tty equals to NULL, sl_tx_timeout() will goto out. Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Jiri Slaby <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20220405132206.55291-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/bpf')
0 files changed, 0 insertions, 0 deletions