| Message ID | 20221116130249.10232-1-linma@zju.edu.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 0ad6bded175e829c2ca261529c9dce39a32a042d |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] nfc/nci: fix race with opening and closing | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Wed, 16 Nov 2022 21:02:49 +0800 you wrote: > Previously we leverage NCI_UNREG and the lock inside nci_close_device to > prevent the race condition between opening a device and closing a > device. However, it still has problem because a failed opening command > will erase the NCI_UNREG flag and allow another opening command to > bypass the status checking. > > This fix corrects that by making sure the NCI_UNREG is held. > > [...] Here is the summary with links: - [v2] nfc/nci: fix race with opening and closing https://git.kernel.org/netdev/net/c/0ad6bded175e You are awesome, thank you!
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 6a193cce2a75..76ade5d4f55a 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev) skb_queue_purge(&ndev->tx_q); ndev->ops->close(ndev); - ndev->flags = 0; + ndev->flags &= BIT(NCI_UNREG); } done:
Previously we leverage NCI_UNREG and the lock inside nci_close_device to prevent the race condition between opening a device and closing a device. However, it still has problem because a failed opening command will erase the NCI_UNREG flag and allow another opening command to bypass the status checking. This fix corrects that by making sure the NCI_UNREG is held. Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race") Signed-off-by: Lin Ma <linma@zju.edu.cn> --- V1 -> V2: should be &= instead of = net/nfc/nci/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)