github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 14:04:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: lapbether: Prevent racing when checking whether the netif is running

Browse Source 
[ Upstream commit 5acd0cfbfb ]

There are two "netif_running" checks in this driver. One is in
"lapbeth_xmit" and the other is in "lapbeth_rcv". They serve to make
sure that the LAPB APIs called in these functions are called before
"lapb_unregister" is called by the "ndo_stop" function.

However, these "netif_running" checks are unreliable, because it's
possible that immediately after "netif_running" returns true, "ndo_stop"
is called (which causes "lapb_unregister" to be called).

This patch adds locking to make sure "lapbeth_xmit" and "lapbeth_rcv" can
reliably check and ensure the netif is running while doing their work.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Xie He 2021-03-10 23:23:09 -08:00 committed by Greg Kroah-Hartman
parent 7cc0ba6788
commit f72e3d81c6
1 changed files with 25 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
drivers/net/wan/lapbether.c
View File

@ -51,6 +51,8 @@ struct lapbethdev {
struct list_head node; struct list_head node;
struct net_device *ethdev; /* link to ethernet device */ struct net_device *ethdev; /* link to ethernet device */
struct net_device *axdev; /* lapbeth device (lapb#) */ struct net_device *axdev; /* lapbeth device (lapb#) */
bool up;
spinlock_t up_lock; /* Protects "up" */
}; };
static LIST_HEAD(lapbeth_devices); static LIST_HEAD(lapbeth_devices);
@ -98,8 +100,9 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
rcu_read_lock(); rcu_read_lock();
lapbeth = lapbeth_get_x25_dev(dev); lapbeth = lapbeth_get_x25_dev(dev);
if (!lapbeth) if (!lapbeth)
goto drop_unlock; goto drop_unlock_rcu;
if (!netif_running(lapbeth->axdev)) spin_lock_bh(&lapbeth->up_lock);
if (!lapbeth->up)
goto drop_unlock; goto drop_unlock;
len = skb->data[0] + skb->data[1] * 256; len = skb->data[0] + skb->data[1] * 256;
@ -114,11 +117,14 @@ static int lapbeth_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
goto drop_unlock; goto drop_unlock;
} }
out: out:
spin_unlock_bh(&lapbeth->up_lock);
rcu_read_unlock(); rcu_read_unlock();
return 0; return 0;
drop_unlock: drop_unlock:
kfree_skb(skb); kfree_skb(skb);
goto out; goto out;
drop_unlock_rcu:
rcu_read_unlock();
drop: drop:
kfree_skb(skb); kfree_skb(skb);
return 0; return 0;
@ -148,13 +154,11 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
struct net_device *dev) struct net_device *dev)
{ {
struct lapbethdev *lapbeth = netdev_priv(dev);
int err; int err;
/* spin_lock_bh(&lapbeth->up_lock);
* Just to be *really* sure not to send anything if the interface if (!lapbeth->up)
* is down, the ethernet device may have gone.
*/
if (!netif_running(dev))
goto drop; goto drop;
/* There should be a pseudo header of 1 byte added by upper layers. /* There should be a pseudo header of 1 byte added by upper layers.
@ -185,6 +189,7 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
goto drop; goto drop;
} }
out: out:
spin_unlock_bh(&lapbeth->up_lock);
return NETDEV_TX_OK; return NETDEV_TX_OK;
drop: drop:
kfree_skb(skb); kfree_skb(skb);
@ -276,6 +281,7 @@ static const struct lapb_register_struct lapbeth_callbacks = {
*/ */
static int lapbeth_open(struct net_device *dev) static int lapbeth_open(struct net_device *dev)
{ {
struct lapbethdev *lapbeth = netdev_priv(dev);
int err; int err;
if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) { if ((err = lapb_register(dev, &lapbeth_callbacks)) != LAPB_OK) {
@ -283,13 +289,22 @@ static int lapbeth_open(struct net_device *dev)
return -ENODEV; return -ENODEV;
} }
spin_lock_bh(&lapbeth->up_lock);
lapbeth->up = true;
spin_unlock_bh(&lapbeth->up_lock);
return 0; return 0;
} }
static int lapbeth_close(struct net_device *dev) static int lapbeth_close(struct net_device *dev)
{ {
struct lapbethdev *lapbeth = netdev_priv(dev);
int err; int err;
spin_lock_bh(&lapbeth->up_lock);
lapbeth->up = false;
spin_unlock_bh(&lapbeth->up_lock);
if ((err = lapb_unregister(dev)) != LAPB_OK) if ((err = lapb_unregister(dev)) != LAPB_OK)
pr_err("lapb_unregister error: %d\n", err); pr_err("lapb_unregister error: %d\n", err);
@ -347,6 +362,9 @@ static int lapbeth_new_device(struct net_device *dev)
dev_hold(dev); dev_hold(dev);
lapbeth->ethdev = dev; lapbeth->ethdev = dev;
lapbeth->up = false;
spin_lock_init(&lapbeth->up_lock);
rc = -EIO; rc = -EIO;
if (register_netdevice(ndev)) if (register_netdevice(ndev))
goto fail; goto fail;