]> git.baikalelectronics.ru Git - kernel.git/commit
ppp: fix refcount underflow on channel unbridge
authorTom Parkin <tparkin@katalix.com>
Thu, 7 Jan 2021 18:13:15 +0000 (18:13 +0000)
committerJakub Kicinski <kuba@kernel.org>
Sat, 9 Jan 2021 03:21:06 +0000 (19:21 -0800)
commit67a18b2c8affee9313016e95332dc28474325060
tree94c6123b8703bfcd561b99bfceaadff453e38b5a
parent57017a5d1ca7504051ce605b6b0a35410150a45f
ppp: fix refcount underflow on channel unbridge

When setting up a channel bridge, ppp_bridge_channels sets the
pch->bridge field before taking the associated reference on the bridge
file instance.

This opens up a refcount underflow bug if ppp_bridge_channels called
via. iotcl runs concurrently with ppp_unbridge_channels executing via.
file release.

The bug is triggered by ppp_bridge_channels taking the error path
through the 'err_unset' label.  In this scenario, pch->bridge is set,
but the reference on the bridged channel will not be taken because
the function errors out.  If ppp_unbridge_channels observes pch->bridge
before it is unset by the error path, it will erroneously drop the
reference on the bridged channel and cause a refcount underflow.

To avoid this, ensure that ppp_bridge_channels holds a reference on
each channel in advance of setting the bridge pointers.

Signed-off-by: Tom Parkin <tparkin@katalix.com>
Fixes: b793e60a2653 ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
Acked-by: Guillaume Nault <gnault@redhat.com>
Link: https://lore.kernel.org/r/20210107181315.3128-1-tparkin@katalix.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ppp/ppp_generic.c