Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1597aac0 authored by Oliver Hartkopp's avatar Oliver Hartkopp Committed by Greg Kroah-Hartman
Browse files

can: gw: synchronize rcu operations before removing gw job entry 

commit fb8696ab14adadb2e3f6c17c18ed26b3ecd96691 upstream.

can_can_gw_rcv() is called under RCU protection, so after calling
can_rx_unregister(), we have to call synchronize_rcu in order to wait
for any RCU read-side critical sections to finish before removing the
kmem_cache entry with the referenced gw job entry.

Link: https://lore.kernel.org/r/20210618173645.2238-1-socketcan@hartkopp.net


Fixes: c1aabdf3 ("can-gw: add netlink based CAN routing")
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarOliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cfb2abd2

net/can/gw.c

+3 −0
Original line number Diff line number Diff line
@@ -497,6 +497,7 @@ static int cgw_notifier(struct notifier_block *nb, 
			if (gwj->src.dev == dev || gwj->dst.dev == dev) {

				hlist_del(&gwj->list);

				cgw_unregister_filter(gwj);

				synchronize_rcu();

				kmem_cache_free(cgw_cache, gwj);

			}

		}
@@ -941,6 +942,7 @@ static void cgw_remove_all_jobs(void) 
	hlist_for_each_entry_safe(gwj, nx, &cgw_list, list) {

		hlist_del(&gwj->list);

		cgw_unregister_filter(gwj);

		synchronize_rcu();

		kmem_cache_free(cgw_cache, gwj);

	}

}
@@ -1008,6 +1010,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh) 


		hlist_del(&gwj->list);

		cgw_unregister_filter(gwj);

		synchronize_rcu();

		kmem_cache_free(cgw_cache, gwj);

		err = 0;

		break;