Re: [PATCH net] ax25: Fix refcount leak issues of ax25_dev
From: <hidden>
Date: 2024-05-09 01:40:30
Also in:
linux-hams, lkml
On Tue, 7 May 2024 11:08:14 +0300 Dan Carpenter wrote:
quoted hunk ↗ jump to hunk
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c index 9169efb2f43a..4d1ab296d52c 100644 --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c@@ -92,6 +92,7 @@ static void ax25_kill_by_device(struct net_device *dev) spin_unlock_bh(&ax25_list_lock); ax25_disconnect(s, ENETUNREACH); s->ax25_dev = NULL; + ax25_dev_put(ax25_dev); ax25_cb_del(s); spin_lock_bh(&ax25_list_lock); goto again;@@ -101,11 +102,8 @@ static void ax25_kill_by_device(struct net_device *dev) lock_sock(sk); ax25_disconnect(s, ENETUNREACH); s->ax25_dev = NULL; - if (sk->sk_socket) { - netdev_put(ax25_dev->dev, - &s->dev_tracker); - ax25_dev_put(ax25_dev); - } + netdev_put(ax25_dev->dev, &s->dev_tracker); + ax25_dev_put(ax25_dev);
We should not decrease the refcount without checking "if (sk->sk_socket)", because there is a race condition between ax25_kill_by_device() and ax25_release(), if we decrease the refcount in ax25_release(), we should not decrease it here, otherwise the refcount underflow will happen. Best regards, Duoming Zhou