Commit ceb95155 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'introduce-refcount_t-for-reference-counting-of-rose_neigh'

Takamitsu Iwai says:

====================
Introduce refcount_t for reference counting of rose_neigh

The current implementation of rose_neigh uses 'use' and 'count' field of
type unsigned short as a reference count. This approach lacks atomicity,
leading to potential race conditions. As a result, syzbot has reported
slab-use-after-free errors due to unintended removals.

This series introduces refcount_t for reference counting to ensure
atomicity and prevent race conditions. The patches are structured as
follows:

1. Refactor rose_remove_neigh() to separate removal and freeing operations
2. Convert 'use' field to refcount_t for appropriate reference counting
3. Include references from rose_node to 'use' field

These changes should resolve the reported slab-use-after-free issues and
improve the overall stability of the ROSE network layer.

v1: https://lore.kernel.org/20250820174707.83372-1-takamitz@amazon.co.jp
====================

Link: https://patch.msgid.link/20250823085857.47674-1-takamitz@amazon.co.jp


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9448ccd8 da9c9c87
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment