- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v4.19.311 commit 424eba06ed405d557077339edb19ce0ebe39e7c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index 8f8c9ede88c2..a5ff7df10505 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -737,7 +737,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH OLK-6.6] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v6.6.23 commit e39a3a14eafcf17f03c037290b78c8f483529028 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index f5e19f3ef6cd..4de514482183 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -737,7 +737,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH OLK-5.10] sr9800: Add check for usbnet_get_endpoints
by felix 01 Apr '24

01 Apr '24

From: Chen Ni <nichen(a)iscas.ac.cn> stable inclusion from stable-v5.10.214 commit 6b4a39acafaf0186ed8e97c16e0aa6fca0e52009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9C6FA CVE: CVE-2024-26651 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ] Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error. Signed-off-by: Chen Ni <nichen(a)iscas.ac.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/net/usb/sr9800.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c index 681e0def6356..a5332e99102a 100644 --- a/drivers/net/usb/sr9800.c +++ b/drivers/net/usb/sr9800.c @@ -736,7 +736,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf) data->eeprom_len = SR9800_EEPROM_LEN; - usbnet_get_endpoints(dev, intf); + ret = usbnet_get_endpoints(dev, intf); + if (ret) + goto out; /* LED Setting Rule : * AABB:CCDD -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tipc: wait and exit until all work queues are done
by Ziyang Xuan 01 Apr '24

01 Apr '24

From: Xin Long <lucien.xin(a)gmail.com> mainline inclusion from mainline-v5.13-rc4 commit 04c26faa51d1e2fe71cf13c45791f5174c37f986 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHRY CVE: CVE-2021-47163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On some host, a crash could be triggered simply by repeating these commands several times: # modprobe tipc # tipc bearer enable media udp name UDP1 localip 127.0.0.1 # rmmod tipc [] BUG: unable to handle kernel paging request at ffffffffc096bb00 [] Workqueue: events 0xffffffffc096bb00 [] Call Trace: [] ? process_one_work+0x1a7/0x360 [] ? worker_thread+0x30/0x390 [] ? create_worker+0x1a0/0x1a0 [] ? kthread+0x116/0x130 [] ? kthread_flush_work_fn+0x10/0x10 [] ? ret_from_fork+0x35/0x40 When removing the TIPC module, the UDP tunnel sock will be delayed to release in a work queue as sock_release() can't be done in rtnl_lock(). If the work queue is schedule to run after the TIPC module is removed, kernel will crash as the work queue function cleanup_beareri() code no longer exists when trying to invoke it. To fix it, this patch introduce a member wq_count in tipc_net to track the numbers of work queues in schedule, and wait and exit until all work queues are done in tipc_exit_net(). Fixes: d0f91938bede ("tipc: add ip/udp media type") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/tipc/core.c net/tipc/core.h net/tipc/udp_media.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/tipc/core.c | 5 +++++ net/tipc/core.h | 3 +++ net/tipc/udp_media.c | 2 ++ 3 files changed, 10 insertions(+) diff --git a/net/tipc/core.c b/net/tipc/core.c index 49bb9fc0aa06..7b61e1650cb0 100644 --- a/net/tipc/core.c +++ b/net/tipc/core.c @@ -92,10 +92,15 @@ static int __net_init tipc_init_net(struct net *net) static void __net_exit tipc_exit_net(struct net *net) { + struct tipc_net *tn = tipc_net(net); + tipc_net_stop(net); tipc_bcast_stop(net); tipc_nametbl_stop(net); tipc_sk_rht_destroy(net); + + while (atomic_read(&tn->wq_count)) + cond_resched(); } static struct pernet_operations tipc_net_ops = { diff --git a/net/tipc/core.h b/net/tipc/core.h index 8020a6c360ff..3abbdbffd460 100644 --- a/net/tipc/core.h +++ b/net/tipc/core.h @@ -122,6 +122,9 @@ struct tipc_net { /* Topology subscription server */ struct tipc_topsrv *topsrv; atomic_t subscription_count; + + /* The numbers of work queues in schedule */ + atomic_t wq_count; }; static inline struct tipc_net *tipc_net(struct net *net) diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c index 1d6235479706..efe822d3bb28 100644 --- a/net/tipc/udp_media.c +++ b/net/tipc/udp_media.c @@ -771,6 +771,7 @@ static void cleanup_bearer(struct work_struct *work) kfree_rcu(rcast, rcu); } + atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); if (ub->ubsock) udp_tunnel_sock_release(ub->ubsock); synchronize_net(); @@ -792,6 +793,7 @@ static void tipc_udp_disable(struct tipc_bearer *b) RCU_INIT_POINTER(ub->bearer, NULL); /* sock_release need to be done outside of rtnl lock */ + atomic_inc(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); INIT_WORK(&ub->work, cleanup_bearer); schedule_work(&ub->work); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFS: Fix an Oopsable condition in __nfs_pageio_add_request()
by ZhaoLong Wang 01 Apr '24

01 Apr '24

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.13-rc4 commit 56517ab958b7c11030e626250c00b9b1a24b41eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHTI CVE: CVE-2021-47167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure that nfs_pageio_error_cleanup() resets the mirror array contents, so that the structure reflects the fact that it is now empty. Also change the test in nfs_pageio_do_add_request() to be more robust by checking whether or not the list is empty rather than relying on the value of pg_count. Fixes: a7d42ddb3099 ("nfs: add mirroring support to pgio layer") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/pagelist.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/pagelist.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c index a9e1bcdd9394..c5f862834b16 100644 --- a/fs/nfs/pagelist.c +++ b/fs/nfs/pagelist.c @@ -964,15 +964,17 @@ static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc, struct nfs_page *prev = NULL; - if (mirror->pg_count != 0) { - prev = nfs_list_entry(mirror->pg_list.prev); - } else { + if (list_empty(&mirror->pg_list)) { if (desc->pg_ops->pg_init) desc->pg_ops->pg_init(desc, req); if (desc->pg_error < 0) return 0; mirror->pg_base = req->wb_pgbase; - } + mirror->pg_count = 0; + mirror->pg_recoalesce = 0; + } else + prev = nfs_list_entry(mirror->pg_list.prev); + if (!nfs_can_coalesce_requests(prev, req, desc)) return 0; nfs_list_move_request(req, &mirror->pg_list); -- 2.39.2

2 1

[PATCH OLK-6.6 v2 0/4] Disable OLK-6.6 configs
by Luo Gengkun 01 Apr '24

01 Apr '24

v1->v2: Remove the disable of CONFIG_PERF_EVENTS_AMD_UNCORE Change the way of disable configs Luo Gengkun (4): x86: configs: Disable CRASH_HOTPLUG x86: configs: Disable X86_KERNEL_IBT x86: configs: Disable PROBE_EVENTS_BTF_ARGS arm64: configs: Disable PROBE_EVENTS_BTF_ARGS arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 7 +++---- 2 files changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] tipc: skb_linearize the head skb when reassembling msgs
by Ziyang Xuan 01 Apr '24

01 Apr '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.193 commit 4b1761898861117c97066aea6c58f68a7787f0bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHF9 CVE: CVE-2021-47162 -------------------------------- commit b7df21cf1b79ab7026f545e7bf837bd5750ac026 upstream. It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs. However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once. The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices: [] kernel BUG at net/core/skbuff.c:1970! [] Call Trace: [] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390 [] kernel BUG at mm/usercopy.c:102! [] Call Trace: [] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0 [] kernel BUG at mm/slub.c:305! [] Call Trace: [] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0 ... This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time. Fixes: 45c8b7b175ce ("tipc: allow non-linear first fragment buffer") Reported-by: Li Shuang <shuali(a)redhat.com> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Jon Maloy <jmaloy(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/tipc/msg.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/net/tipc/msg.c b/net/tipc/msg.c index f04843ca8216..0ac270444974 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -141,18 +141,13 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (unlikely(head)) goto err; *buf = NULL; + if (skb_has_frag_list(frag) && __skb_linearize(frag)) + goto err; frag = skb_unshare(frag, GFP_ATOMIC); if (unlikely(!frag)) goto err; head = *headbuf = frag; TIPC_SKB_CB(head)->tail = NULL; - if (skb_is_nonlinear(head)) { - skb_walk_frags(head, tail) { - TIPC_SKB_CB(head)->tail = tail; - } - } else { - skb_frag_list_init(head); - } return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/5] Disable some OLK-6.6 configs
by Luo Gengkun 01 Apr '24

01 Apr '24

Luo Gengkun (4): x86: configs: Disable CRASH_HOTPLUG x86: configs: Disable X86_KERNEL_IBT x86: configs: Disable PROBE_EVENTS_BTF_ARGS arm64: configs: Disable PROBE_EVENTS_BTF_ARGS arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 9 ++++----- 2 files changed, 5 insertions(+), 6 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP2] arm64/mpam: support MPAM v0.1 version
by Zeng Heng 01 Apr '24

01 Apr '24

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I92AK4 CVE: NA ----------------------------- This supports MPAM v0.1 version for cpufeature detection, check [1] for details. [1] https://developer.arm.com/documentation/ddi0595/2021-12/ AArch64-Registers/ID-AA64PFR1-EL1--AArch64-Processor-Feature-Register-1?lang=en Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 57631fa553f6..df1b1b2fe178 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1294,6 +1294,17 @@ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry, return ctr & BIT(CTR_IDC_SHIFT); } +#ifdef CONFIG_MPAM +static bool has_mpam(const struct arm64_cpu_capabilities *entry, int __unused) +{ + u64 pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); + u64 pfr1 = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1); + + return cpuid_feature_extract_unsigned_field(pfr0, ID_AA64PFR0_MPAM_SHIFT) | + cpuid_feature_extract_unsigned_field(pfr1, ID_AA64PFR1_MPAMFRAC_SHIFT); +} +#endif + static void cpu_emulate_effective_ctr(const struct arm64_cpu_capabilities *__unused) { /* @@ -2004,11 +2015,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .desc = "ARM64 MPAM Extension Support", .capability = ARM64_HAS_MPAM, .type = ARM64_CPUCAP_SCOPE_SYSTEM, - .matches = has_cpuid_feature, - .sys_reg = SYS_ID_AA64PFR0_EL1, - .sign = FTR_UNSIGNED, - .field_pos = ID_AA64PFR0_MPAM_SHIFT, - .min_field_value = ID_AA64PFR0_MPAM, + .matches = has_mpam, }, #endif /* CONFIG_MPAM */ #ifdef CONFIG_ARM64_AMU_EXTN -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 01 Apr '24

01 Apr '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: net/nfc/llcp_core.c --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 5cc3d1629b7a..3a7d9d5bde46 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - u8 *sn, size_t sn_len) + u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static u8 *nfc_llcp_connect_sn(struct sk_buff *skb, size_t *sn_len) @@ -1303,7 +1294,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1323,6 +1315,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1340,6 +1333,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1