[PATCH] lib/error-inject: Traverse list with mutex
From: wuchi <hidden>
Date: 2022-06-20 10:03:42
Also in:
bpf, lkml
Subsystem:
library code, the rest · Maintainers:
Andrew Morton, Linus Torvalds
Traversing list without mutex in get_injectable_error_type will
race with the following code:
list_del_init(&ent->list)
kfree(ent)
in module_unload_ei_list. So fix that.
Signed-off-by: wuchi <redacted>
---
lib/error-inject.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/lib/error-inject.c b/lib/error-inject.c
index 4a4f1278c419..1afca1b1cdea 100644
--- a/lib/error-inject.c
+++ b/lib/error-inject.c@@ -40,12 +40,18 @@ bool within_error_injection_list(unsigned long addr) int get_injectable_error_type(unsigned long addr) { struct ei_entry *ent; + int ei_type = EI_ETYPE_NONE; + mutex_lock(&ei_mutex); list_for_each_entry(ent, &error_injection_list, list) { - if (addr >= ent->start_addr && addr < ent->end_addr) - return ent->etype; + if (addr >= ent->start_addr && addr < ent->end_addr) { + ei_type = ent->etype; + break; + } } - return EI_ETYPE_NONE; + mutex_unlock(&ei_mutex); + + return ei_type; } /*
--
2.20.1