summaryrefslogtreecommitdiffstats
path: root/include/net
diff options
context:
space:
mode:
authorDuoming Zhou <duoming@zju.edu.cn>2022-04-21 13:24:16 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2022-04-27 13:39:45 +0200
commita518be5772d36fcd0e4815d156e06feb137aad82 (patch)
treee8b6ae4e50d18a35cf4f955c2bf20aa5c0525339 /include/net
parente2b558fe507a1ed4c43db2b0057fc6e41f20a14c (diff)
downloadlinux-stable-a518be5772d36fcd0e4815d156e06feb137aad82.tar.gz
linux-stable-a518be5772d36fcd0e4815d156e06feb137aad82.tar.bz2
linux-stable-a518be5772d36fcd0e4815d156e06feb137aad82.zip
ax25: fix reference count leaks of ax25_dev
commit 87563a043cef044fed5db7967a75741cc16ad2b1 upstream. The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") introduces refcount into ax25_dev, but there are reference leak paths in ax25_ctl_ioctl(), ax25_fwd_ioctl(), ax25_rt_add(), ax25_rt_del() and ax25_rt_opt(). This patch uses ax25_dev_put() and adjusts the position of ax25_addr_ax25dev() to fix reference cout leaks of ax25_dev. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20220203150811.42256-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> [OP: backport to 4.19: adjust context] Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/net')
-rw-r--r--include/net/ax25.h8
1 files changed, 5 insertions, 3 deletions
diff --git a/include/net/ax25.h b/include/net/ax25.h
index d81bfb674906..aadff553e4b7 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -291,10 +291,12 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25)
}
}
-#define ax25_dev_hold(__ax25_dev) \
- refcount_inc(&((__ax25_dev)->refcount))
+static inline void ax25_dev_hold(ax25_dev *ax25_dev)
+{
+ refcount_inc(&ax25_dev->refcount);
+}
-static __inline__ void ax25_dev_put(ax25_dev *ax25_dev)
+static inline void ax25_dev_put(ax25_dev *ax25_dev)
{
if (refcount_dec_and_test(&ax25_dev->refcount)) {
kfree(ax25_dev);