Commit 6dc05111 authored Nov 15, 2021 by Lin Ma Committed by Greg Kroah-Hartman Nov 26, 2021

NFC: reorganize the functions in nci_request



[ Upstream commit 86cdf8e38792545161dbe3350a7eced558ba4d15 ]

There is a possible data race as shown below:

thread-A in nci_request()       | thread-B in nci_close_device()
                                | mutex_lock(&ndev->req_lock);
test_bit(NCI_UP, &ndev->flags); |
...                             | test_and_clear_bit(NCI_UP, &ndev->flags)
mutex_lock(&ndev->req_lock);    |
                                |

This race will allow __nci_request() to be awaked while the device is
getting removed.

Similar to commit e2cb6b891ad2 ("bluetooth: eliminate the potential race
condition when removing the HCI controller"). this patch alters the
function sequence in nci_request() to prevent the data races between the
nci_close_device().

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Fixes: 6a2968aa ("NFC: basic NCI protocol implementation")
Link: https://lore.kernel.org/r/20211115145600.8320-1-linma@zju.edu.cn


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 56dab692

net/nfc/nci/core.c

+7 −4

Original line number	Diff line number	Diff line
		@@ -149,12 +149,15 @@ inline int nci_request(struct nci_dev *ndev,
		{
		int rc;

		if (!test_bit(NCI_UP, &ndev->flags))
		return -ENETDOWN;

		/* Serialize all requests */
		mutex_lock(&ndev->req_lock);
		/* check the state after obtaing the lock against any races
		* from nci_close_device when the device gets removed.
		*/
		if (test_bit(NCI_UP, &ndev->flags))
		rc = __nci_request(ndev, req, opt, timeout);
		else
		rc = -ENETDOWN;
		mutex_unlock(&ndev->req_lock);

		return rc;