summaryrefslogtreecommitdiff
path: root/net/mctp/test
diff options
context:
space:
mode:
authorMatt Johnston <matt@codeconstruct.com.au>2022-02-22 12:17:38 +0800
committerDavid S. Miller <davem@davemloft.net>2022-02-23 12:29:15 +0000
commitdc121c0084910db985cf1c8ba6fce5d8c307cc02 (patch)
treed9a2d56d1ded9a273b032beb317d36ea86ffb6f3 /net/mctp/test
parent4767b7e2ed818e97851d236d23f2e2ffa90af6ec (diff)
mctp: make __mctp_dev_get() take a refcount hold
Previously there was a race that could allow the mctp_dev refcount to hit zero: rcu_read_lock(); mdev = __mctp_dev_get(dev); // mctp_unregister() happens here, mdev->refs hits zero mctp_dev_hold(dev); rcu_read_unlock(); Now we make __mctp_dev_get() take the hold itself. It is safe to test against the zero refcount because __mctp_dev_get() is called holding rcu_read_lock and mctp_dev uses kfree_rcu(). Reported-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Matt Johnston <matt@codeconstruct.com.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mctp/test')
-rw-r--r--net/mctp/test/utils.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/net/mctp/test/utils.c b/net/mctp/test/utils.c
index 7b7918702592..e03ba66bbe18 100644
--- a/net/mctp/test/utils.c
+++ b/net/mctp/test/utils.c
@@ -54,7 +54,6 @@ struct mctp_test_dev *mctp_test_create_dev(void)
rcu_read_lock();
dev->mdev = __mctp_dev_get(ndev);
- mctp_dev_hold(dev->mdev);
rcu_read_unlock();
return dev;