Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e00b42cb authored by Lin Ma's avatar Lin Ma Committed by Greg Kroah-Hartman
Browse files

nfc/nci: fix race with opening and closing 



[ Upstream commit 0ad6bded175e829c2ca261529c9dce39a32a042d ]

Previously we leverage NCI_UNREG and the lock inside nci_close_device to
prevent the race condition between opening a device and closing a
device. However, it still has problem because a failed opening command
will erase the NCI_UNREG flag and allow another opening command to
bypass the status checking.

This fix corrects that by making sure the NCI_UNREG is held.

Reported-by: default avatar <syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com>
Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race")
Signed-off-by: default avatarLin Ma <linma@zju.edu.cn>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 04ffa53a

net/nfc/nci/core.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -530,7 +530,7 @@ static int nci_open_device(struct nci_dev *ndev) 
		skb_queue_purge(&ndev->tx_q);

		skb_queue_purge(&ndev->tx_q);





		ndev->ops->close(ndev);

		ndev->ops->close(ndev);

		ndev->flags = 0;

		ndev->flags &= BIT(NCI_UNREG);

	}

	}





done:

done: