mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-11-07 01:49:42 +01:00
Sven Stegemann
52565a9352
syzbot found a race condition when kcm_unattach(psock)
and kcm_release(kcm) are executed at the same time.
kcm_unattach() is missing a check of the flag
kcm->tx_stopped before calling queue_work().
If the kcm has a reserved psock, kcm_unattach() might get executed
between cancel_work_sync() and unreserve_psock() in kcm_release(),
requeuing kcm->tx_work right before kcm gets freed in kcm_done().
Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().
Fixes: ab7ac4eb98 ("kcm: Kernel Connection Multiplexor module")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=e62c9db591c30e174662
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=d199b52665b6c3069b94
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=be6b1fdfeae512726b4e
Signed-off-by: Sven Stegemann <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>