A mirror of the official Linux kernel repository just in case
Go to file
Tom Parkin c1787ffd0d ppp: fix refcount underflow on channel unbridge
When setting up a channel bridge, ppp_bridge_channels sets the
pch->bridge field before taking the associated reference on the bridge
file instance.

This opens up a refcount underflow bug if ppp_bridge_channels called
via. iotcl runs concurrently with ppp_unbridge_channels executing via.
file release.

The bug is triggered by ppp_bridge_channels taking the error path
through the 'err_unset' label.  In this scenario, pch->bridge is set,
but the reference on the bridged channel will not be taken because
the function errors out.  If ppp_unbridge_channels observes pch->bridge
before it is unset by the error path, it will erroneously drop the
reference on the bridged channel and cause a refcount underflow.

To avoid this, ensure that ppp_bridge_channels holds a reference on
each channel in advance of setting the bridge pointers.

Signed-off-by: Tom Parkin <tparkin@katalix.com>
Fixes: 4cf476ced4 ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
Acked-by: Guillaume Nault <gnault@redhat.com>
Link: https://lore.kernel.org/r/20210107181315.3128-1-tparkin@katalix.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-01-08 19:21:06 -08:00
arch Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2021-01-08 12:05:11 -08:00
block SCSI fixes on 20210101 2021-01-01 12:58:07 -08:00
certs .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
crypto crypto: ecdh - avoid buffer overflow in ecdh_set_secret() 2021-01-03 08:35:35 +11:00
Documentation Networking fixes for 5.11-rc3 (part 2), including fixes from bpf and 2021-01-08 12:12:30 -08:00
drivers ppp: fix refcount underflow on channel unbridge 2021-01-08 19:21:06 -08:00
fs poll: fix performance regression due to out-of-line __put_user() 2021-01-08 11:06:29 -08:00
include Networking fixes for 5.11-rc3 (part 2), including fixes from bpf and 2021-01-08 12:12:30 -08:00
init Revert "init/console: Use ttynull as a fallback when there is no console" 2021-01-08 11:02:18 -08:00
ipc Merge branch 'akpm' (patches from Andrew) 2020-12-15 12:53:37 -08:00
kernel Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2021-01-07 15:10:27 -08:00
lib An addition to compiler_attributes.h thanks to: 2021-01-04 10:47:38 -08:00
LICENSES LICENSES: Add the CC-BY-4.0 license 2020-12-08 10:33:27 -07:00
mm mm: make wait_on_page_writeback() wait for multiple pending writebacks 2021-01-05 11:33:00 -08:00
net udp: Prevent reuseport_select_sock from reading uninitialized socks 2021-01-08 19:15:40 -08:00
samples ARM: SoC drivers for v5.11 2020-12-16 16:38:41 -08:00
scripts gcc-plugins: fix gcc 11 indigestion with plugins... 2021-01-06 15:08:23 -08:00
security Provide a fix for the incorrect handling of privilege 2020-12-24 14:08:43 -08:00
sound sound fixes for 5.11-rc3 2021-01-05 13:25:49 -08:00
tools selftests: fib_nexthops: Fix wrong mausezahn invocation 2021-01-07 18:47:19 -08:00
usr Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 13:29:39 -07:00
virt ARM: 2020-12-20 10:44:05 -08:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: docs: ignore sphinx_*/ directories 2020-09-10 10:44:31 -06:00
.mailmap RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-12-11 22:29:38 -08:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: Update MCAN MMIO device driver maintainer 2021-01-07 11:02:10 +01:00
Makefile Linux 5.11-rc2 2021-01-03 15:55:30 -08:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.