diff options
| author | Sven Stegemann <[email protected]> | 2025-08-12 19:18:03 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2025-08-14 01:18:33 +0000 |
| commit | 52565a935213cd6a8662ddb8efe5b4219343a25d (patch) | |
| tree | d54122d658e7e78478dd7563ee94de9da9f54f9d /lib/xarray.c | |
| parent | Merge branch 'ets-use-old-nbands-while-purging-unused-classes' (diff) | |
| download | kernel-52565a935213cd6a8662ddb8efe5b4219343a25d.tar.gz kernel-52565a935213cd6a8662ddb8efe5b4219343a25d.zip | |
net: kcm: Fix race condition in kcm_unattach()
syzbot found a race condition when kcm_unattach(psock)
and kcm_release(kcm) are executed at the same time.
kcm_unattach() is missing a check of the flag
kcm->tx_stopped before calling queue_work().
If the kcm has a reserved psock, kcm_unattach() might get executed
between cancel_work_sync() and unreserve_psock() in kcm_release(),
requeuing kcm->tx_work right before kcm gets freed in kcm_done().
Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=e62c9db591c30e174662
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=d199b52665b6c3069b94
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=be6b1fdfeae512726b4e
Signed-off-by: Sven Stegemann <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'lib/xarray.c')
0 files changed, 0 insertions, 0 deletions