[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6160aa1e-5f77-4d7d-aafd-e1ac7606bf06@linaro.org>
Date: Mon, 18 Dec 2023 10:39:00 +0100
From: Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To: Siddh Raman Pant <code@...dh.me>, "David S. Miller"
<davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Suman Ghosh <sumang@...vell.com>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
syzbot+bbe84a4010eeea00982d@...kaller.appspotmail.com
Subject: Re: [PATCH net-next v6 1/2] nfc: llcp_core: Hold a ref to
llcp_local->dev when holding a ref to llcp_local
On 17/12/2023 14:11, Siddh Raman Pant wrote:
> static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
> @@ -959,8 +974,18 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
> }
>
> new_sock = nfc_llcp_sock(new_sk);
> - new_sock->dev = local->dev;
> +
> new_sock->local = nfc_llcp_local_get(local);
> + if (!new_sock->local) {
> + reason = LLCP_DM_REJ;
> + release_sock(&sock->sk);
> + sock_put(&sock->sk);
> + sock_put(&new_sock->sk);
Why is this needed? Which part earlier gets the reference?
> + nfc_llcp_sock_free(new_sock);
This order is still wrong. Unwinding is almost always done in reversed
order, for good reasons. Why do you unwind in other order?
> + goto fail;
> + }
> +
> + new_sock->dev = local->dev;
> new_sock->rw = sock->rw;
> new_sock->miux = sock->miux;
Best regards,
Krzysztof
Powered by blists - more mailing lists