summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLin Ma <linma@zju.edu.cn>2022-11-16 21:02:49 +0800
committerDavid S. Miller <davem@davemloft.net>2022-11-18 12:37:11 +0000
commit0ad6bded175e829c2ca261529c9dce39a32a042d (patch)
tree928426d6f60597f3ccc94f1de44e0f4166eb63b5
parent24deec6b9e4a051635f75777844ffc184644fec9 (diff)
nfc/nci: fix race with opening and closing
Previously we leverage NCI_UNREG and the lock inside nci_close_device to prevent the race condition between opening a device and closing a device. However, it still has problem because a failed opening command will erase the NCI_UNREG flag and allow another opening command to bypass the status checking. This fix corrects that by making sure the NCI_UNREG is held. Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race") Signed-off-by: Lin Ma <linma@zju.edu.cn> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/nfc/nci/core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 6a193cce2a75..4ffdf2f45c44 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev)
skb_queue_purge(&ndev->tx_q);
ndev->ops->close(ndev);
- ndev->flags = 0;
+ ndev->flags &= BIT(NCI_UNREG);
}
done: