diff options
| author | Richard Palethorpe <[email protected]> | 2020-01-21 14:42:58 +0100 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2020-01-22 20:32:03 +0100 |
| commit | 0ace17d56824165c7f4c68785d6b58971db954dd (patch) | |
| tree | ed49a8e810ee581690f34039e71815510b693e98 /drivers/fpga/fpga-mgr.c | |
| parent | 58c8db929db1c1d785a6f5d8f8692e5dbcc35e84 (diff) | |
can, slip: Protect tty->disc_data in write_wakeup and close with RCU
write_wakeup can happen in parallel with close/hangup where tty->disc_data
is set to NULL and the netdevice is freed thus also freeing
disc_data. write_wakeup accesses disc_data so we must prevent close from
freeing the netdev while write_wakeup has a non-NULL view of
tty->disc_data.
We also need to make sure that accesses to disc_data are atomic. Which can
all be done with RCU.
This problem was found by Syzkaller on SLCAN, but the same issue is
reproducible with the SLIP line discipline using an LTP test based on the
Syzkaller reproducer.
A fix which didn't use RCU was posted by Hillf Danton.
Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup")
Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip")
Reported-by: [email protected]
Signed-off-by: Richard Palethorpe <[email protected]>
Cc: Wolfgang Grandegger <[email protected]>
Cc: Marc Kleine-Budde <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Tyler Hall <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'drivers/fpga/fpga-mgr.c')
0 files changed, 0 insertions, 0 deletions