diff options
| author | Lin Ma <linma@zju.edu.cn> | 2022-11-16 21:02:49 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2022-11-18 12:37:11 +0000 |
| commit | 0ad6bded175e829c2ca261529c9dce39a32a042d (patch) | |
| tree | 928426d6f60597f3ccc94f1de44e0f4166eb63b5 /net/nfc | |
| parent | 24deec6b9e4a051635f75777844ffc184644fec9 (diff) | |
nfc/nci: fix race with opening and closing
Previously we leverage NCI_UNREG and the lock inside nci_close_device to
prevent the race condition between opening a device and closing a
device. However, it still has problem because a failed opening command
will erase the NCI_UNREG flag and allow another opening command to
bypass the status checking.
This fix corrects that by making sure the NCI_UNREG is held.
Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com
Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/nfc')
| -rw-r--r-- | net/nfc/nci/core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 6a193cce2a75..4ffdf2f45c44 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev) skb_queue_purge(&ndev->tx_q); ndev->ops->close(ndev); - ndev->flags = 0; + ndev->flags &= BIT(NCI_UNREG); } done: |