llc: use refcount_inc_not_zero() for llc_sap_find() (0dcb8225) · Commits · 戴 / test

llc_sap_put() decreases the refcnt before deleting sap from the global list. Therefore, there is a chance llc_sap_find() could find a sap with zero refcnt in this global list. Close this race condition by checking if refcnt is zero or not in llc_sap_find(), if it is zero then it is being removed so we can just treat it as gone. Reported-by:

<syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com> Signed-off-by:

Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

include/net/llc.h

+5 −0

Original line number	Diff line number	Diff line
		@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
		refcount_inc(&sap->refcnt);
		}

		static inline bool llc_sap_hold_safe(struct llc_sap *sap)
		{
		return refcount_inc_not_zero(&sap->refcnt);
		}

		void llc_sap_close(struct llc_sap *sap);

		static inline void llc_sap_put(struct llc_sap *sap)

net/llc/llc_core.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)

		rcu_read_lock_bh();
		sap = __llc_sap_find(sap_value);
		if (sap)
		llc_sap_hold(sap);
		if (!sap \|\| !llc_sap_hold_safe(sap))
		sap = NULL;
		rcu_read_unlock_bh();
		return sap;
		}

Admin message