iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
a44406ec3d
linux/net/rds
History
Ka-Cheong Poon 84eef2b218 rds: Incorrect reference counting in TCP socket creation 
Commit 0933a578cd ("rds: tcp: use sock_create_lite() to create the
accept socket") has a reference counting issue in TCP socket creation
when accepting a new connection.  The code uses sock_create_lite() to
create a kernel socket.  But it does not do __module_get() on the
socket owner.  When the connection is shutdown and sock_release() is
called to free the socket, the owner's reference count is decremented
and becomes incorrect.  Note that this bug only shows up when the socket
owner is configured as a kernel module.

v2: Update comments

Fixes: 0933a578cd ("rds: tcp: use sock_create_lite() to create the accept socket")
Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-03-02 09:40:27 -05:00
..
af_rds.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
bind.c rds; Reset rs->rs_bound_addr in rds_add_bound() failure path 2017-12-27 13:37:27 -05:00
cong.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
connection.c rds: do not call ->conn_alloc with GFP_KERNEL 2018-02-13 13:52:02 -05:00
ib_cm.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
ib_fmr.c net/rds/ib_fmr.c: use kmalloc_array_node() 2017-11-15 18:21:02 -08:00
ib_frmr.c RDS: IB: split the mr registration and invalidation path 2017-01-02 14:02:47 -08:00
ib_mr.h rds: ib: add the static type to the function 2017-03-13 23:20:05 -07:00
ib_rdma.c RDS: IB: Initialize max_items based on underlying device attributes 2017-10-05 21:16:33 -07:00
ib_recv.c rds: ib: Fix NULL pointer dereference in debug code 2017-11-10 14:54:47 +09:00
ib_ring.c
ib_send.c rds: Fix inaccurate accounting of unsignaled wrs 2017-10-26 17:35:57 +09:00
ib_stats.c RDS: IB: add few useful cache stasts 2017-01-02 14:02:51 -08:00
ib_sysctl.c
ib.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
ib.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-04 09:26:51 +09:00
info.c
info.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig RDS: Drop stale iWARP RDMA transport 2016-03-02 14:13:17 -05:00
loop.c RDS: TCP: Hooks to set up a single connection path 2016-07-01 16:45:17 -04:00
loop.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
message.c net, rds: convert rds_message.m_refcount from atomic_t to refcount_t 2017-07-04 22:35:18 +01:00
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma_transport.c RDS: RDMA: start rdma listening after init 2017-01-02 14:02:45 -08:00
rdma_transport.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rdma.c RDS: null pointer dereference in rds_atomic_free_op 2018-01-04 14:19:26 -05:00
rds_single_path.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rds.h rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
recv.c net, rds: convert rds_incoming.i_refcount from atomic_t to refcount_t 2017-07-04 22:35:17 +01:00
send.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
stats.c
sysctl.c net: rds: fix coding style issues 2016-06-18 21:34:09 -07:00
tcp_connect.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
tcp_listen.c rds: Incorrect reference counting in TCP socket creation 2018-03-02 09:40:27 -05:00
tcp_recv.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
tcp_send.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
tcp_stats.c
tcp.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
tcp.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-23 13:51:56 -05:00
threads.c rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management 2018-02-08 15:23:52 -05:00
transport.c rds: remove unnecessary returned value check 2017-03-03 09:51:22 -08:00