46cea215dc
There is a theoretical race window in j1939_sk_netdev_event_unregister()
where two j1939_sk_bind() calls jump in between read_unlock_bh() and
lock_sock().
The assumption jsk->priv == priv can fail if the first j1939_sk_bind()
call once made jsk->priv == NULL due to failed j1939_local_ecu_get() call
and the second j1939_sk_bind() call again made jsk->priv != NULL due to
successful j1939_local_ecu_get() call.
Since the socket lock is held by both j1939_sk_netdev_event_unregister()
and j1939_sk_bind(), checking ndev->reg_state with the socket lock held can
reliably make the second j1939_sk_bind() call fail (and close this race
window).
Fixes:
|
||
|---|---|---|
| .. | ||
| j1939 | ||
| Kconfig | ||
| Makefile | ||
| af_can.c | ||
| af_can.h | ||
| bcm.c | ||
| gw.c | ||
| isotp.c | ||
| proc.c | ||
| raw.c | ||