Commit b01377a4 authored by's avatar Committed by David S. Miller

caif: Bugfix list_del_rcu race in cfmuxl_ctrlcmd.

Always use cfmuxl_remove_uplayer when removing a up-layer.
cfmuxl_ctrlcmd() can be called independently and in parallel with
cfmuxl_remove_uplayer(). The race between them could cause list_del_rcu
to be called on a node which has been already taken out from the list.
That lead to a (rare) crash on accessing poisoned node->prev inside

This fix ensures that deletion are done holding the same lock.
Reported-by: default avatarDmitry Tarnyagin <>
Signed-off-by: default avatarSjur Brændeland <>
Signed-off-by: default avatarDavid S. Miller <>
parent c31c151b
......@@ -248,7 +248,6 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
struct cfmuxl *muxl = container_obj(layr);
struct cflayer *layer;
int idx;
list_for_each_entry_rcu(layer, &muxl->srvl_list, node) {
......@@ -257,14 +256,9 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
layer->id != 0) {
idx = layer->id % UP_CACHE_SIZE;
RCU_INIT_POINTER(muxl->up_cache[idx], NULL);
layer->id != 0)
cfmuxl_remove_uplayer(layr, layer->id);
/* NOTE: ctrlcmd is not allowed to block */
layer->ctrlcmd(layer, ctrl, phyid);
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment