diff options
| author | Duoming Zhou <duoming@zju.edu.cn> | 2022-02-03 23:08:11 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-02-03 14:20:36 -0800 |
| commit | 87563a043cef044fed5db7967a75741cc16ad2b1 (patch) | |
| tree | 4afe345736b9d1e946ddd4ad5fdbc349b046900f /include/net | |
| parent | 80d4609008e6d696a279e39ae7458c916fcd44c1 (diff) | |
| download | linux-87563a043cef044fed5db7967a75741cc16ad2b1.tar.gz linux-87563a043cef044fed5db7967a75741cc16ad2b1.tar.bz2 linux-87563a043cef044fed5db7967a75741cc16ad2b1.zip | |
ax25: fix reference count leaks of ax25_dev
The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev
to avoid UAF bugs") introduces refcount into ax25_dev, but there
are reference leak paths in ax25_ctl_ioctl(), ax25_fwd_ioctl(),
ax25_rt_add(), ax25_rt_del() and ax25_rt_opt().
This patch uses ax25_dev_put() and adjusts the position of
ax25_addr_ax25dev() to fix reference cout leaks of ax25_dev.
Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20220203150811.42256-1-duoming@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/ax25.h | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/include/net/ax25.h b/include/net/ax25.h index 50b417df6221..8221af1811df 100644 --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -294,10 +294,12 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25) } } -#define ax25_dev_hold(__ax25_dev) \ - refcount_inc(&((__ax25_dev)->refcount)) +static inline void ax25_dev_hold(ax25_dev *ax25_dev) +{ + refcount_inc(&ax25_dev->refcount); +} -static __inline__ void ax25_dev_put(ax25_dev *ax25_dev) +static inline void ax25_dev_put(ax25_dev *ax25_dev) { if (refcount_dec_and_test(&ax25_dev->refcount)) { kfree(ax25_dev); |