summaryrefslogtreecommitdiff
path: root/drivers/Makefile
diff options
context:
space:
mode:
authorZhang Changzhong <zhangchangzhong@huawei.com>2023-09-15 14:20:41 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-10-25 12:54:26 +0300
commit657a3ca8236c45a3b5358985c807991e0697dabf (patch)
treeccb1c5b57b68949e893c9f93975a7b7c738abd6a /drivers/Makefile
parent5d5680755bcef70b484602f16de40fcb324cb784 (diff)
downloadlinux-657a3ca8236c45a3b5358985c807991e0697dabf.tar.xz
xfrm6: fix inet6_dev refcount underflow problem
[ Upstream commit cc9b364bb1d58d3dae270c7a931a8cc717dc2b3b ] There are race conditions that may lead to inet6_dev refcount underflow in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev(). One of the refcount underflow bugs is shown below: (cpu 1) | (cpu 2) xfrm6_dst_destroy() | ... | in6_dev_put() | | rt6_uncached_list_flush_dev() ... | ... | in6_dev_put() rt6_uncached_list_del() | ... ... | xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(), so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put() again for the same inet6_dev. Fix it by moving in6_dev_put() after rt6_uncached_list_del() in xfrm6_dst_destroy(). Fixes: 510c321b5571 ("xfrm: reuse uncached_list to track xdsts") Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/Makefile')
0 files changed, 0 insertions, 0 deletions