5a8e7aea95
WHen an llc sock is added into the sk_laddr_hash of an llc_sap, it is not marked with SOCK_RCU_FREE. This causes that the sock could be freed while it is still being read by __llc_lookup_established() with RCU read lock. sock is refcounted, but with RCU read lock, nothing prevents the readers getting a zero refcnt. Fix it by setting SOCK_RCU_FREE in llc_sap_add_socket(). Reported-by: syzbot+11e05f04c15e03be5254@syzkaller.appspotmail.com Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| af_llc.c | ||
| llc_c_ac.c | ||
| llc_c_ev.c | ||
| llc_c_st.c | ||
| llc_conn.c | ||
| llc_core.c | ||
| llc_if.c | ||
| llc_input.c | ||
| llc_output.c | ||
| llc_pdu.c | ||
| llc_proc.c | ||
| llc_s_ac.c | ||
| llc_s_ev.c | ||
| llc_s_st.c | ||
| llc_sap.c | ||
| llc_station.c | ||
| sysctl_net_llc.c | ||