A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

llc: use refcount_inc_not_zero() for llc_sap_find()

Browse source 
llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.

Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.

Reported-by: <[email protected]>
Signed-off-by: Cong Wang <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Cong Wang 2018-08-07 12:41:38 -07:00 • committed by David S. Miller
commit 0dcb82254d
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
net/llc/llc_core.c
View file

@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
rcu_read_lock_bh();
sap = __llc_sap_find(sap_value);
if (sap)
llc_sap_hold(sap);
if (!sap || !llc_sap_hold_safe(sap))
sap = NULL;
rcu_read_unlock_bh();
return sap;
}