Patch "tipc: add reference counter to bearer" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tipc: add reference counter to bearer

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tipc-add-reference-counter-to-bearer.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d824d7e2a6eacc64760b7c548d4c680e37adb2c3
Author: Tuong Lien <tuong.t.lien@xxxxxxxxxxxxxx>
Date:   Fri Nov 8 12:05:08 2019 +0700

    tipc: add reference counter to bearer
    
    [ Upstream commit 2a7ee696f7b000a970dcce0cb06fdcd0a9e6ee76 ]
    
    As a need to support the crypto asynchronous operations in the later
    commits, apart from the current RCU mechanism for bearer pointer, we
    add a 'refcnt' to the bearer object as well.
    
    So, a bearer can be hold via 'tipc_bearer_hold()' without being freed
    even though the bearer or interface can be disabled in the meanwhile.
    If that happens, the bearer will be released then when the crypto
    operation is completed and 'tipc_bearer_put()' is called.
    
    Acked-by: Ying Xue <ying.xue@xxxxxxxxxxxxxx>
    Acked-by: Jon Maloy <jon.maloy@xxxxxxxxxxxx>
    Signed-off-by: Tuong Lien <tuong.t.lien@xxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Stable-dep-of: 6a2fa13312e5 ("tipc: Fix use-after-free of kernel socket in cleanup_bearer().")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index dc5c6b1e97910..fc0b787fb9286 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -334,6 +334,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
 	b->net_plane = bearer_id + 'A';
 	b->priority = prio;
 	test_and_set_bit_lock(0, &b->up);
+	refcount_set(&b->refcnt, 1);
 
 	res = tipc_disc_create(net, b, &b->bcast_addr, &skb);
 	if (res) {
@@ -371,6 +372,17 @@ static int tipc_reset_bearer(struct net *net, struct tipc_bearer *b)
 	return 0;
 }
 
+bool tipc_bearer_hold(struct tipc_bearer *b)
+{
+	return (b && refcount_inc_not_zero(&b->refcnt));
+}
+
+void tipc_bearer_put(struct tipc_bearer *b)
+{
+	if (b && refcount_dec_and_test(&b->refcnt))
+		kfree_rcu(b, rcu);
+}
+
 /**
  * bearer_disable
  *
@@ -389,7 +401,7 @@ static void bearer_disable(struct net *net, struct tipc_bearer *b)
 	if (b->disc)
 		tipc_disc_delete(b->disc);
 	RCU_INIT_POINTER(tn->bearer_list[bearer_id], NULL);
-	kfree_rcu(b, rcu);
+	tipc_bearer_put(b);
 	tipc_mon_delete(net, bearer_id);
 }
 
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index ea0f3c49cbedb..faca696d422ff 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -165,6 +165,7 @@ struct tipc_bearer {
 	struct tipc_discoverer *disc;
 	char net_plane;
 	unsigned long up;
+	refcount_t refcnt;
 };
 
 struct tipc_bearer_names {
@@ -210,6 +211,8 @@ int tipc_media_set_window(const char *name, u32 new_value);
 int tipc_media_addr_printf(char *buf, int len, struct tipc_media_addr *a);
 int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
 			 struct nlattr *attrs[]);
+bool tipc_bearer_hold(struct tipc_bearer *b);
+void tipc_bearer_put(struct tipc_bearer *b);
 void tipc_disable_l2_media(struct tipc_bearer *b);
 int tipc_l2_send_msg(struct net *net, struct sk_buff *buf,
 		     struct tipc_bearer *b, struct tipc_media_addr *dest);