Sean Tranchetti
978e0388c2
af_key: unconditionally clone on broadcast ...
[ Upstream commit fc2d5cfdcfe2ab76b263d91429caa22451123085 ]
Attempting to avoid cloning the skb when broadcasting by inflating
the refcount with sock_hold/sock_put while under RCU lock is dangerous
and violates RCU principles. It leads to subtle race conditions when
attempting to free the SKB, as we may reference sockets that have
already been freed by the stack.
Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b
[006b6b6b6b6b6c4b] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1 ] PREEMPT SMP
task: fffffff78f65b380 task.stack: ffffff8049a88000
pc : sock_rfree+0x38/0x6c
lr : skb_release_head_state+0x6c/0xcc
Process repro (pid: 7117, stack limit = 0xffffff8049a88000)
Call trace:
sock_rfree+0x38/0x6c
skb_release_head_state+0x6c/0xcc
skb_release_all+0x1c/0x38
__kfree_skb+0x1c/0x30
kfree_skb+0xd0/0xf4
pfkey_broadcast+0x14c/0x18c
pfkey_sendmsg+0x1d8/0x408
sock_sendmsg+0x44/0x60
___sys_sendmsg+0x1d0/0x2a8
__sys_sendmsg+0x64/0xb4
SyS_sendmsg+0x34/0x4c
el0_svc_naked+0x34/0x38
Kernel panic - not syncing: Fatal exception
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-03-23 20:09:48 +01:00
6lowpan: iphc: reset mac_header after decompress to fix panic
2018-07-06 12:32:12 +02:00
9p/net: fix memory leak in p9_client_create
2019-03-23 20:09:38 +01:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
Revert "net: simplify sock_poll_wait"
2018-11-04 14:50:51 +01:00
ax25: fix possible use-after-free
2019-02-23 09:07:27 +01:00
batman-adv: release station info tidstats
2019-03-13 14:02:34 -07:00
Bluetooth: Fix locking in bt_accept_enqueue() for BH context
2019-03-10 07:17:21 +01:00
bpf/test_run: support cgroup local storage
2018-08-03 00:47:32 +02:00
net: bpfilter: use get_pid_task instead of pid_task
2018-10-17 22:03:40 -07:00
netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present
2019-03-13 14:02:29 -07:00
Revert "net: simplify sock_poll_wait"
2018-11-04 14:50:51 +01:00
can: bcm: check timer values before ktime conversion
2019-01-31 08:14:39 +01:00
libceph: handle an empty authorize reply
2019-02-27 10:08:50 +01:00
bpf: only adjust gso_size on bytestream protocols
2019-03-23 20:09:48 +01:00
net: dcb: Add priority-to-DSCP map getters
2018-07-27 13:17:50 -07:00
dccp: fool proof ccid_hc_[rt]x_parse_options()
2019-02-12 19:47:21 +01:00
decnet: fix using plain integer as NULL warning
2018-08-09 14:11:24 -07:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
net: dsa: slave: Don't propagate flag changes on down slave interfaces
2019-02-12 19:47:22 +01:00
net: Convert GRO SKB handling to list_head.
2018-06-26 11:33:04 +09:00
net/hsr: fix possible crash in add_timer()
2019-03-19 13:12:38 +01:00
ieee802154: lowpan_header_create check must check daddr
2019-01-09 17:38:31 +01:00
esp: Skip TX bytes accounting when sending from a request socket
2019-03-23 20:09:48 +01:00
esp: Skip TX bytes accounting when sending from a request socket
2019-03-23 20:09:48 +01:00
Revert "net: simplify sock_poll_wait"
2018-11-04 14:50:51 +01:00
Revert "kcm: remove any offset before parsing messages"
2018-09-17 18:43:42 -07:00
af_key: unconditionally clone on broadcast
2019-03-23 20:09:48 +01:00
l2tp: fix infoleak in l2tp_ip6_recvmsg()
2019-03-19 13:12:38 +01:00
llc: do not use sk_eat_skb()
2018-12-01 09:37:27 +01:00
mac80211: Fix Tx aggregation session tear down with ITXQs
2019-03-23 20:09:45 +01:00
net: mac802154: tx: expand tailroom if necessary
2018-08-06 11:21:37 +02:00
mpls: Return error for RTA_GATEWAY attribute
2019-03-10 07:17:19 +01:00
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
2018-08-22 21:39:08 -07:00
ipvs: fix dependency on nf_defrag_ipv6
2019-03-23 20:09:45 +01:00
netlabel: fix out-of-bounds memory accesses
2019-03-10 07:17:18 +01:00
Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net
2018-08-05 13:04:31 -07:00
netrom: switch to sock timer API
2019-02-06 17:30:07 +01:00
net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
2019-03-10 07:17:18 +01:00
nsh: set mac len based on inner packet
2018-07-12 16:55:29 -07:00
openvswitch: Avoid OOB read when parsing flow nlattrs
2019-01-31 08:14:32 +01:00
net/packet: fix 4gb buffer limit due to overflow check
2019-02-27 10:08:58 +01:00
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
net: qrtr: Reset the node and port ID of broadcast messages
2018-07-05 20:20:03 +09:00
rds: fix refcount bug in rds_sock_addref
2019-02-12 19:47:22 +01:00
Here are quite a large number of fixes, notably:
2018-09-03 22:12:02 -07:00
net/rose: fix NULL ax25_cb kernel panic
2019-02-06 17:30:07 +01:00
rxrpc: Fix client call queueing, waiting for channel
2019-03-19 13:12:39 +01:00
net: sched: flower: insert new filter to idr after setting its mask
2019-03-19 13:12:41 +01:00
sctp: remove sched init from sctp_stream_init
2019-03-19 13:12:39 +01:00
net/smc: fix smc_poll in SMC_INIT state
2019-03-19 13:12:41 +01:00
strparser: remove redundant variable 'rd_desc'
2018-08-01 10:00:06 -07:00
xprtrdma: Make sure Send CQ is allocated on an existing compvec
2019-03-23 20:09:45 +01:00
tipc: fix race condition causing hung sendto
2019-03-10 07:17:18 +01:00
net/tls: Init routines in create_ctx
2019-01-13 09:51:00 +01:00
missing barriers in some of unix_sock ->addr and ->path accesses
2019-03-19 13:12:41 +01:00
vsock/virtio: reset connected sockets on device removal
2019-03-13 14:02:36 -07:00
wimax: remove blank lines at EOF
2018-07-24 14:10:42 -07:00
cfg80211: extend range deviation for DMG
2019-03-05 17:58:52 +01:00
net/x25: fix a race in x25_bind()
2019-03-19 13:12:40 +01:00
xsk: do not call synchronize_net() under RCU read lock
2018-10-11 10:19:01 +02:00
xfrm: refine validation of template and selector families
2019-02-15 08:10:13 +01:00
sock: Make sock->sk_stamp thread-safe
2019-01-09 17:38:33 +01:00
net: remove blank lines at end of file
2018-07-24 14:10:43 -07:00
bpfilter: check compiler capability in Kconfig
2018-06-28 13:36:39 +09:00
net: socket: set sock->sk to NULL after calling proto_ops::release()
2019-03-10 07:17:18 +01:00
978e0388c2