Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b01377a4 authored by sjur.brandeland@stericsson.com's avatar sjur.brandeland@stericsson.com Committed by David S. Miller
Browse files

caif: Bugfix list_del_rcu race in cfmuxl_ctrlcmd. 



Always use cfmuxl_remove_uplayer when removing a up-layer.
cfmuxl_ctrlcmd() can be called independently and in parallel with
cfmuxl_remove_uplayer(). The race between them could cause list_del_rcu
to be called on a node which has been already taken out from the list.
That lead to a (rare) crash on accessing poisoned node->prev inside
list_del_rcu.

This fix ensures that deletion are done holding the same lock.

Reported-by: default avatarDmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
Signed-off-by: default avatarSjur Brændeland <sjur.brandeland@stericsson.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c31c151b

net/caif/cfmuxl.c

+3 −9
Original line number Diff line number Diff line
@@ -248,7 +248,6 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl, 
{

	struct cfmuxl *muxl = container_obj(layr);

	struct cflayer *layer;

	int idx;



	rcu_read_lock();

	list_for_each_entry_rcu(layer, &muxl->srvl_list, node) {
@@ -257,14 +256,9 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl, 


			if ((ctrl == _CAIF_CTRLCMD_PHYIF_DOWN_IND ||

				ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&

					layer->id != 0) {

					layer->id != 0)

				cfmuxl_remove_uplayer(layr, layer->id);



				idx = layer->id % UP_CACHE_SIZE;

				spin_lock_bh(&muxl->receive_lock);

				RCU_INIT_POINTER(muxl->up_cache[idx], NULL);

				list_del_rcu(&layer->node);

				spin_unlock_bh(&muxl->receive_lock);

			}

			/* NOTE: ctrlcmd is not allowed to block */

			layer->ctrlcmd(layer, ctrl, phyid);

		}