mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 00:39:48 +00:00
c1787ffd0d
When setting up a channel bridge, ppp_bridge_channels sets the
pch->bridge field before taking the associated reference on the bridge
file instance.
This opens up a refcount underflow bug if ppp_bridge_channels called
via. iotcl runs concurrently with ppp_unbridge_channels executing via.
file release.
The bug is triggered by ppp_bridge_channels taking the error path
through the 'err_unset' label. In this scenario, pch->bridge is set,
but the reference on the bridged channel will not be taken because
the function errors out. If ppp_unbridge_channels observes pch->bridge
before it is unset by the error path, it will erroneously drop the
reference on the bridged channel and cause a refcount underflow.
To avoid this, ensure that ppp_bridge_channels holds a reference on
each channel in advance of setting the bridge pointers.
Signed-off-by: Tom Parkin <tparkin@katalix.com>
Fixes:
|
||
---|---|---|
.. | ||
appletalk | ||
arcnet | ||
bonding | ||
caif | ||
can | ||
dsa | ||
ethernet | ||
fddi | ||
fjes | ||
hamradio | ||
hippi | ||
hyperv | ||
ieee802154 | ||
ipa | ||
ipvlan | ||
mdio | ||
netdevsim | ||
pcs | ||
phy | ||
plip | ||
ppp | ||
slip | ||
team | ||
usb | ||
vmxnet3 | ||
wan | ||
wireguard | ||
wireless | ||
xen-netback | ||
bareudp.c | ||
dummy.c | ||
eql.c | ||
geneve.c | ||
gtp.c | ||
ifb.c | ||
Kconfig | ||
LICENSE.SRC | ||
loopback.c | ||
macsec.c | ||
macvlan.c | ||
macvtap.c | ||
Makefile | ||
mdio.c | ||
mhi_net.c | ||
mii.c | ||
net_failover.c | ||
netconsole.c | ||
nlmon.c | ||
ntb_netdev.c | ||
rionet.c | ||
sb1000.c | ||
Space.c | ||
sungem_phy.c | ||
tap.c | ||
thunderbolt.c | ||
tun.c | ||
veth.c | ||
virtio_net.c | ||
vrf.c | ||
vsockmon.c | ||
vxlan.c | ||
xen-netfront.c |