Eric Dumazet
aef419ef77
dccp: fix tasklet usage
[ Upstream commit a8d7aa17bbc970971ccdf71988ea19230ab368b1 ]
syzbot reported a crash in tasklet_action_common() caused by dccp.
dccp needs to make sure socket wont disappear before tasklet handler
has completed.
This patch takes a reference on the socket when arming the tasklet,
and moves the sock_put() from dccp_write_xmit_timer() to dccp_write_xmitlet()
kernel BUG at kernel/softirq.c:514!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc3+ #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515
RSP: 0018:ffff8801d9b3faf8 EFLAGS: 00010246
dccp_close: ABORT with 65423 bytes unread
RAX: 1ffff1003b367f6b RBX: ffff8801daf1f3f0 RCX: 0000000000000000
RDX: ffff8801cf895498 RSI: 0000000000000004 RDI: 0000000000000000
RBP: ffff8801d9b3fc40 R08: ffffed0039f12a95 R09: ffffed0039f12a94
dccp_close: ABORT with 65423 bytes unread
R10: ffffed0039f12a94 R11: ffff8801cf8954a3 R12: 0000000000000000
R13: ffff8801d9b3fc18 R14: dffffc0000000000 R15: ffff8801cf895490
FS: 0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2bc28000 CR3: 00000001a08a9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
tasklet_action+0x1d/0x20 kernel/softirq.c:533
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
dccp_close: ABORT with 65423 bytes unread
run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
kthread+0x345/0x410 kernel/kthread.c:238
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 48 8b 85 e8 fe ff ff 48 8b 95 f0 fe ff ff e9 94 fb ff ff 48 89 95 f0 fe ff ff e8 81 53 6e 00 48 8b 95 f0 fe ff ff e9 62 fb ff ff <0f> 0b 48 89 cf 48 89 8d e8 fe ff ff e8 64 53 6e 00 48 8b 8d e8
RIP: tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515 RSP: ffff8801d9b3faf8
Fixes: dc841e30ea ("dccp: Extend CCID packet dequeueing interface")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: dccp@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2018-05-19 10:26:57 +02:00 |
| .. |
|
6lowpan
|
6lowpan: ndisc: no overreact if no short address is available
|
2016-09-19 20:19:34 +02:00 |
|
9p
|
9p/trans_virtio: discard zero-length reply
|
2018-02-22 15:43:50 +01:00 |
|
802
|
|
|
|
8021q
|
vlan: also check phy_driver ts_info for vlan's real device
|
2018-04-13 19:48:34 +02:00 |
|
appletalk
|
appletalk: use IS_ENABLED() instead of checking for built-in or module
|
2016-09-10 21:19:10 -07:00 |
|
atm
|
net: atm: Fix potential Spectre v1
|
2018-05-16 10:08:44 +02:00 |
|
ax25
|
ax25: Fix segfault after sock connection timeout
|
2017-02-04 09:47:09 +01:00 |
|
batman-adv
|
batman-adv: handle race condition for claims between gateways
|
2018-03-22 09:17:41 +01:00 |
|
bluetooth
|
Bluetooth: Fix connection if directed advertising and privacy is used
|
2018-04-20 08:21:07 +02:00 |
|
bridge
|
bridge: check iface upper dev when setting master via ioctl
|
2018-05-19 10:26:57 +02:00 |
|
caif
|
net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
|
2017-07-05 14:40:14 +02:00 |
|
can
|
can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once
|
2018-01-31 12:55:50 +01:00 |
|
ceph
|
libceph: validate con->state at the top of try_write()
|
2018-05-01 15:13:09 -07:00 |
|
core
|
net: fix uninit-value in __hw_addr_add_ex()
|
2018-05-16 10:08:41 +02:00 |
|
dcb
|
net: dcb: set error code on failures
|
2016-12-03 23:54:25 -05:00 |
|
dccp
|
dccp: fix tasklet usage
|
2018-05-19 10:26:57 +02:00 |
|
decnet
|
dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
|
2018-02-25 11:05:44 +01:00 |
|
dns_resolver
|
KEYS: DNS: limit the length of option strings
|
2018-04-29 11:32:00 +02:00 |
|
dsa
|
net: dsa: select NET_SWITCHDEV
|
2017-11-15 15:53:17 +01:00 |
|
ethernet
|
net: introduce device min_header_len
|
2017-02-18 15:11:43 +01:00 |
|
hsr
|
hsr: fix incorrect warning
|
2018-04-13 19:48:29 +02:00 |
|
ieee802154
|
net: ieee802154: fix net_device reference release too early
|
2018-04-13 19:48:04 +02:00 |
|
ipv4
|
tcp: fix TCP_REPAIR_QUEUE bound checking
|
2018-05-16 10:08:41 +02:00 |
|
ipv6
|
ipv6: add RTA_TABLE and RTA_PREFSRC to rtm_ipv6_policy
|
2018-04-29 11:32:02 +02:00 |
|
ipx
|
ipx: call ipxitf_put() in ioctl error path
|
2017-05-25 15:44:41 +02:00 |
|
irda
|
irda: do not leak initialized list.dev to userspace
|
2017-08-30 10:21:42 +02:00 |
|
iucv
|
net/iucv: Free memory obtained by kzalloc
|
2018-03-31 18:11:34 +02:00 |
|
kcm
|
kcm: Call strp_stop before strp_done in kcm_attach
|
2018-05-16 10:08:40 +02:00 |
|
key
|
af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
|
2018-04-13 19:47:51 +02:00 |
|
l2tp
|
l2tp: check sockaddr length in pppol2tp_connect()
|
2018-04-29 11:32:00 +02:00 |
|
l3mdev
|
net: ipv6: Remove l3mdev_get_saddr6
|
2016-09-10 23:12:53 -07:00 |
|
lapb
|
|
|
|
llc
|
llc: fix NULL pointer deref for SOCK_ZAPPED
|
2018-04-29 11:32:01 +02:00 |
|
mac80211
|
mac80211: Fix setting TX power on monitor interfaces
|
2018-04-13 19:48:10 +02:00 |
|
mac802154
|
mac802154: use rate limited warnings for malformed frames
|
2016-09-19 20:19:34 +02:00 |
|
mpls
|
mpls, nospec: Sanitize array index in mpls_label_ok()
|
2018-03-11 16:21:34 +01:00 |
|
ncsi
|
net/ncsi: Improve HNCDSC AEN handler
|
2016-10-20 11:23:08 -04:00 |
|
netfilter
|
ipvs: fix rtnl_lock lockups caused by start_sync_thread
|
2018-05-16 10:08:40 +02:00 |
|
netlabel
|
netlabel: Implement CALIPSO config functions for SMACK.
|
2016-06-27 15:06:18 -04:00 |
|
netlink
|
netlink: fix uninit-value in netlink_sendmsg
|
2018-05-16 10:08:40 +02:00 |
|
netrom
|
|
|
|
nfc
|
NFC: fix device-allocation error return
|
2017-11-30 08:39:07 +00:00 |
|
openvswitch
|
openvswitch: Delete conntrack entry clashing with an expectation.
|
2018-03-24 11:00:14 +01:00 |
|
packet
|
net: af_packet: fix race in PACKET_{R|T}X_RING
|
2018-04-29 11:32:02 +02:00 |
|
phonet
|
|
|
|
qrtr
|
net: qrtr: Mark 'buf' as little endian
|
2017-12-09 22:01:51 +01:00 |
|
rds
|
rds: MP-RDS may use an invalid c_path
|
2018-04-20 08:21:07 +02:00 |
|
rfkill
|
rfkill: gpio: fix memory leak in probe error path
|
2018-05-16 10:08:43 +02:00 |
|
rose
|
rose: limit sk_filter trim to payload
|
2016-07-13 11:53:40 -07:00 |
|
rxrpc
|
rxrpc: check return value of skb_to_sgvec always
|
2018-04-13 19:48:31 +02:00 |
|
sched
|
net: sched: ife: signal not finding metaid
|
2018-04-29 11:32:01 +02:00 |
|
sctp
|
sctp: do not check port in sctp_inet6_cmp_addr
|
2018-04-29 11:32:01 +02:00 |
|
strparser
|
strparser: Fix incorrect strp->need_bytes value.
|
2018-04-29 11:32:02 +02:00 |
|
sunrpc
|
rpc_pipefs: fix double-dput()
|
2018-04-24 09:34:17 +02:00 |
|
switchdev
|
switchdev: Execute bridge ndos only for bridge ports
|
2016-10-19 10:58:04 -04:00 |
|
tipc
|
tipc: add policy for TIPC_NLA_NET_ADDR
|
2018-04-29 11:32:01 +02:00 |
|
unix
|
net/unix: don't show information about sockets from other namespaces
|
2017-11-18 11:22:22 +01:00 |
|
vmw_vsock
|
vsock: cancel packets when failing to connect
|
2017-12-25 14:23:38 +01:00 |
|
wimax
|
|
|
|
wireless
|
cfg80211: Fix array-bounds warning in fragment copy
|
2018-04-08 12:12:46 +02:00 |
|
x25
|
net: x25: fix one potential use-after-free issue
|
2018-04-13 19:48:00 +02:00 |
|
xfrm
|
xfrm: fix state migration copy replay sequence numbers
|
2018-04-13 19:48:02 +02:00 |
|
compat.c
|
audit: log 32-bit socketcalls
|
2017-10-08 10:26:06 +02:00 |
|
Kconfig
|
strparser: Stream parser for messages
|
2016-08-17 19:36:23 -04:00 |
|
Makefile
|
strparser: Stream parser for messages
|
2016-08-17 19:36:23 -04:00 |
|
socket.c
|
bpf: introduce BPF_JIT_ALWAYS_ON config
|
2018-01-31 12:55:56 +01:00 |
|
sysctl_net.c
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
|
2016-10-06 09:52:23 -07:00 |