summaryrefslogtreecommitdiff
path: root/mm
diff options
context:
space:
mode:
authorZiyang Xuan <william.xuanziyang@huawei.com>2021-10-09 15:40:30 +0800
committerMarc Kleine-Budde <mkl@pengutronix.de>2021-10-17 14:18:21 +0200
commit43a08c3bdac4cb42eff8fe5e2278bffe0c5c3daa (patch)
treef27f25c918a99025f0886a9d0f7ee68a9f3595a3 /mm
parent9acf636215a6ce9362fe618e7da4913b8bfe84c8 (diff)
downloadlwn-43a08c3bdac4cb42eff8fe5e2278bffe0c5c3daa.tar.gz
lwn-43a08c3bdac4cb42eff8fe5e2278bffe0c5c3daa.zip
can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg()
When isotp_sendmsg() concurrent, tx.state of all TX processes can be ISOTP_IDLE. The conditions so->tx.state != ISOTP_IDLE and wq_has_sleeper(&so->wait) can not protect TX buffer from being accessed by multiple TX processes. We can use cmpxchg() to try to modify tx.state to ISOTP_SENDING firstly. If the modification of the previous process succeed, the later process must wait tx.state to ISOTP_IDLE firstly. Thus, we can ensure TX buffer is accessed by only one process at the same time. And we should also restore the original tx.state at the subsequent error processes. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/c2517874fbdf4188585cf9ddf67a8fa74d5dbde5.1633764159.git.william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'mm')
0 files changed, 0 insertions, 0 deletions