dpll: rely on rcu for netdev_dpll_pin()
This fixes a possible UAF in if_nlmsg_size(),
which can run without RTNL.
Add rcu protection to "struct dpll_pin"
Move netdev_dpll_pin() from netdevice.h to dpll.h to
decrease name pollution.
Note: This looks possible to no longer acquire RTNL in
netdev_dpll_pin_assign() later in net-next.
v2: do not force rcu_read_lock() in rtnl_dpll_pin_size() (Jiri Pirko)
Fixes: 5f18426928 ("netdev: expose DPLL pin handle for netdevice")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Cc: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20240223123208.3543319-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
committed by
Jakub Kicinski
parent
0e67899abf
commit
0d60d8df6f
@@ -564,7 +564,7 @@ void dpll_pin_put(struct dpll_pin *pin)
|
||||
xa_destroy(&pin->parent_refs);
|
||||
xa_erase(&dpll_pin_xa, pin->id);
|
||||
dpll_pin_prop_free(&pin->prop);
|
||||
kfree(pin);
|
||||
kfree_rcu(pin, rcu);
|
||||
}
|
||||
mutex_unlock(&dpll_lock);
|
||||
}
|
||||
|
||||
@@ -47,6 +47,7 @@ struct dpll_device {
|
||||
* @prop: pin properties copied from the registerer
|
||||
* @rclk_dev_name: holds name of device when pin can recover clock from it
|
||||
* @refcount: refcount
|
||||
* @rcu: rcu_head for kfree_rcu()
|
||||
**/
|
||||
struct dpll_pin {
|
||||
u32 id;
|
||||
@@ -57,6 +58,7 @@ struct dpll_pin {
|
||||
struct xarray parent_refs;
|
||||
struct dpll_pin_properties prop;
|
||||
refcount_t refcount;
|
||||
struct rcu_head rcu;
|
||||
};
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user