diff options
author | Vivien Didelot <vivien.didelot@savoirfairelinux.com> | 2017-11-24 11:36:06 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2017-11-26 04:23:10 +0900 |
commit | 9e741045faea17e28663f14a45f7f3304827c968 (patch) | |
tree | 4dfbc3cad712b5fe159534f0a74259e5bc48256e /include | |
parent | afbea2cd253b5198350dfd8edb963567d05827d6 (diff) | |
download | linux-stable-9e741045faea17e28663f14a45f7f3304827c968.tar.gz linux-stable-9e741045faea17e28663f14a45f7f3304827c968.tar.bz2 linux-stable-9e741045faea17e28663f14a45f7f3304827c968.zip |
net: dsa: fix 'increment on 0' warning
Setting the refcount to 0 when allocating a tree to match the number of
switch devices it holds may cause an 'increment on 0; use-after-free',
if CONFIG_REFCOUNT_FULL is enabled.
To fix this, do not decrement the refcount of a newly allocated tree,
increment it when an already allocated tree is found, and decrement it
after the probing of a switch, as done with the previous behavior.
At the same time, make dsa_tree_get and dsa_tree_put accept a NULL
argument to simplify callers, and return the tree after incrementation,
as most kref users like of_node_get and of_node_put do.
Fixes: 8e5bf9759a06 ("net: dsa: simplify tree reference counting")
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions