Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 71e6f3f1 authored by Cong Wang's avatar Cong Wang Committed by Greg Kroah-Hartman
Browse files

llc: use refcount_inc_not_zero() for llc_sap_find() 



[ Upstream commit 0dcb82254d65f72333aa50ad626d1e9665ad093b ]

llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.

Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.

Reported-by: default avatar <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 719710e9

include/net/llc.h

+5 −0
Original line number Diff line number Diff line
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap) 
	atomic_inc(&sap->refcnt);

}



static inline bool llc_sap_hold_safe(struct llc_sap *sap)

{

	return atomic_inc_not_zero(&sap->refcnt);

}



void llc_sap_close(struct llc_sap *sap);



static inline void llc_sap_put(struct llc_sap *sap)

net/llc/llc_core.c

+2 −2
Original line number Diff line number Diff line
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value) 


	rcu_read_lock_bh();

	sap = __llc_sap_find(sap_value);

	if (sap)

		llc_sap_hold(sap);

	if (!sap || !llc_sap_hold_safe(sap))

		sap = NULL;

	rcu_read_unlock_bh();

	return sap;

}