Commit 0dcb8225 authored by Cong Wang's avatar Cong Wang Committed by David S. Miller

llc: use refcount_inc_not_zero() for llc_sap_find()

llc_sap_put() decreases the refcnt before deleting sap
from the global list. Therefore, there is a chance
llc_sap_find() could find a sap with zero refcnt
in this global list.

Close this race condition by checking if refcnt is zero
or not in llc_sap_find(), if it is zero then it is being
removed so we can just treat it as gone.

Reported-by: <>
Signed-off-by: default avatarCong Wang <>
Signed-off-by: default avatarDavid S. Miller <>
parent 61ef4b07
......@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap)
static inline bool llc_sap_hold_safe(struct llc_sap *sap)
return refcount_inc_not_zero(&sap->refcnt);
void llc_sap_close(struct llc_sap *sap);
static inline void llc_sap_put(struct llc_sap *sap)
......@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value)
sap = __llc_sap_find(sap_value);
if (sap)
if (!sap || !llc_sap_hold_safe(sap))
sap = NULL;
return sap;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment