llc: use refcount_inc_not_zero() for llc_sap_find()

llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.

Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.

Reported-by: <syzbot+278893f3f7803871f7ce@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/llc.h b/include/net/llc.h
index dc35f25eb679d4651b59a20c785005aa0cbb4d0f..890a87318014d528a78a3a9631ebdb75bf037a4b 100644 (file)
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
        refcount_inc(&sap->refcnt);
 }
 
+static inline bool llc_sap_hold_safe(struct llc_sap *sap)
+{
+       return refcount_inc_not_zero(&sap->refcnt);
+}
+
 void llc_sap_close(struct llc_sap *sap);
 
 static inline void llc_sap_put(struct llc_sap *sap)

diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 89041260784c0871195556074f7138eee01edb33..260b3dc1b4a2ab4545982b0b36478d6a6cf0b71f 100644 (file)
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
 
        rcu_read_lock_bh();
        sap = __llc_sap_find(sap_value);
-       if (sap)
-               llc_sap_hold(sap);
+       if (!sap || !llc_sap_hold_safe(sap))
+               sap = NULL;
        rcu_read_unlock_bh();
        return sap;
 }