| From 480efe9830bd0edc8f863d0ef6c4f2a8d5967793 Mon Sep 17 00:00:00 2001 |
| From: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Date: Wed, 26 Dec 2018 22:09:34 +0800 |
| Subject: isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug |
| in HFCPCI_l1hw() |
| |
| [ Upstream commit 7418e6520f22a2e35815122fa5a53d5bbfa2c10f ] |
| |
| In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and |
| HFCPCI_l1hw() may be concurrently executed. |
| |
| HFCPCI_l1hw() |
| line 1173: if (!cs->tx_skb) |
| |
| hfcpci_interrupt() |
| line 942: spin_lock_irqsave(); |
| line 1066: dev_kfree_skb_irq(cs->tx_skb); |
| |
| Thus, a possible concurrency use-after-free bug may occur |
| in HFCPCI_l1hw(). |
| |
| To fix these bugs, the calls to spin_lock_irqsave() and |
| spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the |
| access to cs->tx_skb. |
| |
| Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/isdn/hisax/hfc_pci.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c |
| index f9ca35cc32b1..b42d27a4c950 100644 |
| --- a/drivers/isdn/hisax/hfc_pci.c |
| +++ b/drivers/isdn/hisax/hfc_pci.c |
| @@ -1169,11 +1169,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg) |
| if (cs->debug & L1_DEB_LAPD) |
| debugl1(cs, "-> PH_REQUEST_PULL"); |
| #endif |
| + spin_lock_irqsave(&cs->lock, flags); |
| if (!cs->tx_skb) { |
| test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags); |
| st->l1.l1l2(st, PH_PULL | CONFIRM, NULL); |
| } else |
| test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags); |
| + spin_unlock_irqrestore(&cs->lock, flags); |
| break; |
| case (HW_RESET | REQUEST): |
| spin_lock_irqsave(&cs->lock, flags); |
| -- |
| 2.19.1 |
| |
