nfc/nci: fix race with opening and closing
authorLin Ma <linma@zju.edu.cn>
Wed, 16 Nov 2022 13:02:49 +0000 (21:02 +0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 18 Nov 2022 12:37:11 +0000 (12:37 +0000)
Previously we leverage NCI_UNREG and the lock inside nci_close_device to
prevent the race condition between opening a device and closing a
device. However, it still has problem because a failed opening command
will erase the NCI_UNREG flag and allow another opening command to
bypass the status checking.

This fix corrects that by making sure the NCI_UNREG is held.

Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com
Fixes: 48b71a9e66c2 ("NFC: add NCI_UNREG flag to eliminate the race")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/nfc/nci/core.c

index 6a193cc..4ffdf2f 100644 (file)
@@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev)
                skb_queue_purge(&ndev->tx_q);
 
                ndev->ops->close(ndev);
-               ndev->flags = 0;
+               ndev->flags &= BIT(NCI_UNREG);
        }
 
 done: