mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-22 02:20:40 +00:00
dc121c0084
Previously there was a race that could allow the mctp_dev refcount to hit zero: rcu_read_lock(); mdev = __mctp_dev_get(dev); // mctp_unregister() happens here, mdev->refs hits zero mctp_dev_hold(dev); rcu_read_unlock(); Now we make __mctp_dev_get() take the hold itself. It is safe to test against the zero refcount because __mctp_dev_get() is called holding rcu_read_lock and mctp_dev uses kfree_rcu(). Reported-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Matt Johnston <matt@codeconstruct.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
66 lines
1.3 KiB
C
66 lines
1.3 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
#include <linux/netdevice.h>
|
|
#include <linux/mctp.h>
|
|
#include <linux/if_arp.h>
|
|
|
|
#include <net/mctpdevice.h>
|
|
#include <net/pkt_sched.h>
|
|
|
|
#include "utils.h"
|
|
|
|
static netdev_tx_t mctp_test_dev_tx(struct sk_buff *skb,
|
|
struct net_device *ndev)
|
|
{
|
|
kfree_skb(skb);
|
|
return NETDEV_TX_OK;
|
|
}
|
|
|
|
static const struct net_device_ops mctp_test_netdev_ops = {
|
|
.ndo_start_xmit = mctp_test_dev_tx,
|
|
};
|
|
|
|
static void mctp_test_dev_setup(struct net_device *ndev)
|
|
{
|
|
ndev->type = ARPHRD_MCTP;
|
|
ndev->mtu = MCTP_DEV_TEST_MTU;
|
|
ndev->hard_header_len = 0;
|
|
ndev->addr_len = 0;
|
|
ndev->tx_queue_len = DEFAULT_TX_QUEUE_LEN;
|
|
ndev->flags = IFF_NOARP;
|
|
ndev->netdev_ops = &mctp_test_netdev_ops;
|
|
ndev->needs_free_netdev = true;
|
|
}
|
|
|
|
struct mctp_test_dev *mctp_test_create_dev(void)
|
|
{
|
|
struct mctp_test_dev *dev;
|
|
struct net_device *ndev;
|
|
int rc;
|
|
|
|
ndev = alloc_netdev(sizeof(*dev), "mctptest%d", NET_NAME_ENUM,
|
|
mctp_test_dev_setup);
|
|
if (!ndev)
|
|
return NULL;
|
|
|
|
dev = netdev_priv(ndev);
|
|
dev->ndev = ndev;
|
|
|
|
rc = register_netdev(ndev);
|
|
if (rc) {
|
|
free_netdev(ndev);
|
|
return NULL;
|
|
}
|
|
|
|
rcu_read_lock();
|
|
dev->mdev = __mctp_dev_get(ndev);
|
|
rcu_read_unlock();
|
|
|
|
return dev;
|
|
}
|
|
|
|
void mctp_test_destroy_dev(struct mctp_test_dev *dev)
|
|
{
|
|
mctp_dev_put(dev->mdev);
|
|
unregister_netdev(dev->ndev);
|
|
}
|