There are two issues with the way psp_dev is used in nsim_do_psp():
1. There is no check for IS_ERR() on the peers psp_dev, before
dereferencing.
2. The refcount on this psp_dev can be dropped by
nsim_psp_rereg_write()
To fix this, we can make netdevsim's reference to its psp_dev an rcu
reference, and then nsim_do_psp() can read the fields it needs from an
rcu critical section.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| bpf.c | ||
| bus.c | ||
| dev.c | ||
| ethtool.c | ||
| fib.c | ||
| health.c | ||
| hwstats.c | ||
| ipsec.c | ||
| macsec.c | ||
| netdev.c | ||
| netdevsim.h | ||
| psample.c | ||
| psp.c | ||
| tc.c | ||
| udp_tunnels.c | ||