From b901a4e276943f61e11ddb597a0abc1e7dfadf0f Mon Sep 17 00:00:00 2001 From: Dmitry Safonov Date: Fri, 22 Dec 2023 01:13:59 +0000 Subject: net/tcp_sigpool: Use kref_get_unless_zero() The freeing and re-allocation of algorithm are protected by cpool_mutex, so it doesn't fix an actual use-after-free, but avoids a deserved refcount_warn_saturate() warning. A trivial fix for the racy behavior. Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO") Suggested-by: Eric Dumazet Signed-off-by: Dmitry Safonov Tested-by: Bagas Sanjaya Reported-by: syzbot Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller --- net/ipv4/tcp_sigpool.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'net/ipv4') diff --git a/net/ipv4/tcp_sigpool.c b/net/ipv4/tcp_sigpool.c index 55b310a722c7..8512cb09ebc0 100644 --- a/net/ipv4/tcp_sigpool.c +++ b/net/ipv4/tcp_sigpool.c @@ -162,9 +162,8 @@ int tcp_sigpool_alloc_ahash(const char *alg, size_t scratch_size) if (strcmp(cpool[i].alg, alg)) continue; - if (kref_read(&cpool[i].kref) > 0) - kref_get(&cpool[i].kref); - else + /* pairs with tcp_sigpool_release() */ + if (!kref_get_unless_zero(&cpool[i].kref)) kref_init(&cpool[i].kref); ret = i; goto out; -- cgit