Commit b01377a4 authored by Committed by David S. Miller
caif: Bugfix list_del_rcu race in cfmuxl_ctrlcmd.
Always use cfmuxl_remove_uplayer when removing a up-layer. cfmuxl_ctrlcmd() can be called independently and in parallel with cfmuxl_remove_uplayer(). The race between them could cause list_del_rcu to be called on a node which has been already taken out from the list. That lead to a (rare) crash on accessing poisoned node->prev inside list_del_rcu. This fix ensures that deletion are done holding the same lock. Reported-by: Dmitry Tarnyagin <firstname.lastname@example.org> Signed-off-by: Sjur Brændeland <email@example.com> Signed-off-by: David S. Miller <firstname.lastname@example.org>
Showing with 3 additions and 9 deletions