mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
![]() Setting the refcount to 0 when allocating a tree to match the number of
switch devices it holds may cause an 'increment on 0; use-after-free',
if CONFIG_REFCOUNT_FULL is enabled.
To fix this, do not decrement the refcount of a newly allocated tree,
increment it when an already allocated tree is found, and decrement it
after the probing of a switch, as done with the previous behavior.
At the same time, make dsa_tree_get and dsa_tree_put accept a NULL
argument to simplify callers, and return the tree after incrementation,
as most kref users like of_node_get and of_node_put do.
Fixes:
|
||
---|---|---|
.. | ||
dsa.c | ||
dsa2.c | ||
dsa_priv.h | ||
Kconfig | ||
legacy.c | ||
Makefile | ||
master.c | ||
port.c | ||
slave.c | ||
switch.c | ||
tag_brcm.c | ||
tag_dsa.c | ||
tag_edsa.c | ||
tag_ksz.c | ||
tag_lan9303.c | ||
tag_mtk.c | ||
tag_qca.c | ||
tag_trailer.c |