FEX-Emu/linux
1
0
Fork 0
mirror of https://github.com/FEX-Emu/linux.git synced 2024-12-30 13:38:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4647706ebe
linux/net/rxrpc
History
David Howells 9a19bad70c rxrpc: Fix oops when discarding a preallocated service call 
rxrpc_service_prealloc_one() doesn't set the socket pointer on any new call
it preallocates, but does add it to the rxrpc net namespace call list.
This, however, causes rxrpc_put_call() to oops when the call is discarded
when the socket is closed.  rxrpc_put_call() needs the socket to be able to
reach the namespace so that it can use a lock held therein.

Fix this by setting a call's socket pointer immediately before discarding
it.

This can be triggered by unloading the kafs module, resulting in an oops
like the following:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
IP: rxrpc_put_call+0x1e2/0x32d
PGD 0
P4D 0
Oops: 0000 [#1] SMP
Modules linked in: kafs(E-)
CPU: 3 PID: 3037 Comm: rmmod Tainted: G            E   4.12.0-fscache+ #213
Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014
task: ffff8803fc92e2c0 task.stack: ffff8803fef74000
RIP: 0010:rxrpc_put_call+0x1e2/0x32d
RSP: 0018:ffff8803fef77e08 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8803fab99ac0 RCX: 000000000000000f
RDX: ffffffff81c50a40 RSI: 000000000000000c RDI: ffff8803fc92ea88
RBP: ffff8803fef77e30 R08: ffff8803fc87b941 R09: ffffffff82946d20
R10: ffff8803fef77d10 R11: 00000000000076fc R12: 0000000000000005
R13: ffff8803fab99c20 R14: 0000000000000001 R15: ffffffff816c6aee
FS:  00007f915a059700(0000) GS:ffff88041fb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000030 CR3: 00000003fef39000 CR4: 00000000001406e0
Call Trace:
 rxrpc_discard_prealloc+0x325/0x341
 rxrpc_listen+0xf9/0x146
 kernel_listen+0xb/0xd
 afs_close_socket+0x3e/0x173 [kafs]
 afs_exit+0x1f/0x57 [kafs]
 SyS_delete_module+0x10f/0x19a
 do_syscall_64+0x8a/0x149
 entry_SYSCALL64_slow_path+0x25/0x25

Fixes: 2baec2c3f8 ("rxrpc: Support network namespacing")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-08-18 16:23:23 -07:00
..
af_rxrpc.c net: convert sock.sk_refcnt from atomic_t to refcount_t 2017-07-01 07:39:08 -07:00
ar-internal.h rxrpc: Cache the congestion window setting 2017-06-14 15:42:45 -04:00
call_accept.c rxrpc: Fix oops when discarding a preallocated service call 2017-08-18 16:23:23 -07:00
call_event.c
call_object.c rxrpc: Cache the congestion window setting 2017-06-14 15:42:45 -04:00
conn_client.c rxrpc: Cache the congestion window setting 2017-06-14 15:42:45 -04:00
conn_event.c
conn_object.c rxrpc: Cache the congestion window setting 2017-06-14 15:42:45 -04:00
conn_service.c rxrpc: Implement service upgrade 2017-06-05 14:30:49 +01:00
input.c rxrpc: Add service upgrade support for client connections 2017-06-05 14:30:49 +01:00
insecure.c
Kconfig
key.c rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2017-06-15 14:23:44 -04:00
local_event.c
local_object.c rxrpc: Permit multiple service binding 2017-06-05 14:30:49 +01:00
Makefile
misc.c
net_ns.c
output.c rxrpc: Add service upgrade support for client connections 2017-06-05 14:30:49 +01:00
peer_event.c
peer_object.c rxrpc: Cache the congestion window setting 2017-06-14 15:42:45 -04:00
proc.c
recvmsg.c
rxkad.c
security.c rxrpc: Permit multiple service binding 2017-06-05 14:30:49 +01:00
sendmsg.c networking: convert many more places to skb_put_zero() 2017-06-16 11:48:35 -04:00
skbuff.c net: convert sk_buff.users from atomic_t to refcount_t 2017-07-01 07:39:07 -07:00
sysctl.c
utils.c