diff mbox series

[v2] nfc/nci: fix race with opening and closing

Message ID 20221116130249.10232-1-linma@zju.edu.cn
State New
Headers
Series [v2] nfc/nci: fix race with opening and closing |

Commit Message

Lin Ma Nov. 16, 2022, 1:02 p.m. UTC 
  Previously we leverage NCI_UNREG and the lock inside nci_close_device to
prevent the race condition between opening a device and closing a
device. However, it still has problem because a failed opening command
will erase the NCI_UNREG flag and allow another opening command to
bypass the status checking.

This fix corrects that by making sure the NCI_UNREG is held.

Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com
Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
---
V1 -> V2: should be &= instead of =
 net/nfc/nci/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

patchwork-bot+netdevbpf@kernel.org Nov. 18, 2022, 12:40 p.m. UTC | #1 
Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Wed, 16 Nov 2022 21:02:49 +0800 you wrote:
> Previously we leverage NCI_UNREG and the lock inside nci_close_device to
> prevent the race condition between opening a device and closing a
> device. However, it still has problem because a failed opening command
> will erase the NCI_UNREG flag and allow another opening command to
> bypass the status checking.
> 
> This fix corrects that by making sure the NCI_UNREG is held.
> 
> [...]

Here is the summary with links:
  - [v2] nfc/nci: fix race with opening and closing
    https://git.kernel.org/netdev/net/c/0ad6bded175e

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 6a193cce2a75..76ade5d4f55a 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -542,7 +542,7 @@  static int nci_open_device(struct nci_dev *ndev)
 		skb_queue_purge(&ndev->tx_q);
 
 		ndev->ops->close(ndev);
-		ndev->flags = 0;
+		ndev->flags &= BIT(NCI_UNREG);
 	}
 
 done: