iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net
History
Eric Dumazet a8d7aa17bb dccp: fix tasklet usage 
syzbot reported a crash in tasklet_action_common() caused by dccp.

dccp needs to make sure socket wont disappear before tasklet handler
has completed.

This patch takes a reference on the socket when arming the tasklet,
and moves the sock_put() from dccp_write_xmit_timer() to dccp_write_xmitlet()

kernel BUG at kernel/softirq.c:514!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.17.0-rc3+ #30
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515
RSP: 0018:ffff8801d9b3faf8 EFLAGS: 00010246
dccp_close: ABORT with 65423 bytes unread
RAX: 1ffff1003b367f6b RBX: ffff8801daf1f3f0 RCX: 0000000000000000
RDX: ffff8801cf895498 RSI: 0000000000000004 RDI: 0000000000000000
RBP: ffff8801d9b3fc40 R08: ffffed0039f12a95 R09: ffffed0039f12a94
dccp_close: ABORT with 65423 bytes unread
R10: ffffed0039f12a94 R11: ffff8801cf8954a3 R12: 0000000000000000
R13: ffff8801d9b3fc18 R14: dffffc0000000000 R15: ffff8801cf895490
FS:  0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2bc28000 CR3: 00000001a08a9000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 tasklet_action+0x1d/0x20 kernel/softirq.c:533
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
dccp_close: ABORT with 65423 bytes unread
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
Code: 48 8b 85 e8 fe ff ff 48 8b 95 f0 fe ff ff e9 94 fb ff ff 48 89 95 f0 fe ff ff e8 81 53 6e 00 48 8b 95 f0 fe ff ff e9 62 fb ff ff <0f> 0b 48 89 cf 48 89 8d e8 fe ff ff e8 64 53 6e 00 48 8b 8d e8
RIP: tasklet_action_common.isra.19+0x6db/0x700 kernel/softirq.c:515 RSP: ffff8801d9b3faf8

Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: dccp@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-05-03 15:14:57 -04:00
..
6lowpan
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
9p
net/9p/client.c: fix potential refcnt problem of trans module
2018-04-05 21:36:23 -07:00
802
treewide: setup_timer() -> timer_setup()
2017-11-21 15:57:07 -08:00
8021q
vlan: also check phy_driver ts_info for vlan's real device
2018-04-01 20:53:50 -04:00
appletalk
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
atm
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
ax25
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
batman-adv
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-04-01 19:49:34 -04:00
bluetooth
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
2018-04-08 17:19:15 -04:00
bpf
bpf: fix null pointer deref in bpf_prog_test_run_xdp
2018-02-01 07:43:56 -08:00
bridge
bridge: check iface upper dev when setting master via ioctl
2018-04-29 21:08:02 -04:00
caif
net: caif: fix spelling mistake "UKNOWN" -> "UNKNOWN"
2018-04-19 13:37:10 -04:00
can
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
ceph
The big ticket items are:
2018-04-10 12:25:30 -07:00
core
ethtool: fix a potential missing-check bug
2018-05-01 14:18:47 -04:00
dcb
…
dccp
dccp: fix tasklet usage
2018-05-03 15:14:57 -04:00
decnet
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
dns_resolver
KEYS: DNS: limit the length of option strings
2018-04-17 15:17:41 -04:00
dsa
net: dsa: Discard frames from unused ports
2018-04-08 10:34:49 -04:00
ethernet
…
hsr
…
ieee802154
inet: frags: fix ip6frag_low_thresh boundary
2018-04-04 12:04:59 -04:00
ife
net: sched: ife: check on metadata length
2018-04-22 21:12:00 -04:00
ipv4
tcp: restore autocorking
2018-05-03 11:28:50 -04:00
ipv6
ipv6: Revert "ipv6: Allow non-gateway ECMP for IPv6"
2018-05-02 16:33:02 -04:00
iucv
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-03-23 11:31:58 -04:00
kcm
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
key
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
l2tp
l2tp: check sockaddr length in pppol2tp_connect()
2018-04-23 21:10:43 -04:00
l3mdev
…
lapb
treewide: Remove TIMER_FUNC_TYPE and TIMER_DATA_TYPE casts
2017-11-21 16:35:54 -08:00
llc
llc: fix NULL pointer deref for SOCK_ZAPPED
2018-04-22 14:56:22 -04:00
mac80211
We have a fair number of patches, but many of them are from the
2018-03-29 16:23:26 -04:00
mac802154
net/mac802154: disambiguate mac80215 vs mac802154 trace events
2018-03-28 22:55:18 +02:00
mpls
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
ncsi
net/ncsi: check for null return from call to nla_nest_start
2018-03-27 10:38:26 -04:00
netfilter
netfilter: xt_connmark: do not cast xt_connmark_tginfo1 to xt_connmark_tginfo2
2018-04-19 16:19:28 +02:00
netlabel
netlabel: If PF_INET6, check sk_buff ip header version
2018-02-14 14:01:41 -05:00
netlink
netlink: fix uninit-value in netlink_sendmsg
2018-04-07 22:32:31 -04:00
netrom
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
nfc
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-02-19 18:46:11 -05:00
nsh
openvswitch: enable NSH support
2017-11-08 16:12:33 +09:00
openvswitch
ovs: Remove rtnl_lock() from ovs_exit_net()
2018-03-29 13:47:54 -04:00
packet
packet: fix bitfield update race
2018-04-24 13:17:08 -04:00
phonet
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00
psample
MAINTAINERS: Update Yotam's E-mail
2017-11-01 12:19:03 +09:00
qrtr
net: qrtr: add MODULE_ALIAS_NETPROTO macro
2018-04-17 09:58:00 -04:00
rds
rds: do not leak kernel memory to user land
2018-05-03 11:26:14 -04:00
rfkill
vfs: do bulk POLL* -> EPOLL* replacement
2018-02-11 14:34:03 -08:00
rose
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
rxrpc
rxrpc: Fix undefined packet handling
2018-04-04 11:04:08 -04:00
sched
net_sched: fq: take care of throttled flows before reuse
2018-05-02 16:37:38 -04:00
sctp
sctp: fix the issue that the cookie-ack with auth can't get processed
2018-05-02 11:15:33 -04:00
smc
smc: fix sendpage() call
2018-05-03 14:47:31 -04:00
strparser
strparser: Do not call mod_delayed_work with a timeout of LONG_MAX
2018-04-22 21:09:16 -04:00
sunrpc
rpc_pipefs: fix double-dput()
2018-04-15 23:49:27 -04:00
switchdev
net: bridge: Add/del switchdev object on host join/leave
2017-11-10 13:41:40 +09:00
tipc
tipc: fix bug in function tipc_nl_node_dump_monitor
2018-04-27 11:03:56 -04:00
tls
net/tls: Don't recursively call push_record during tls_write_space callbacks
2018-05-01 18:57:52 -04:00
unix
af_unix: remove redundant lockdep class
2018-04-04 11:13:40 -04:00
vmw_vsock
VSOCK: make af_vsock.ko removable again
2018-04-17 09:44:30 -04:00
wimax
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
wireless
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2018-03-31 23:33:04 -04:00
x25
net: Use octal not symbolic permissions
2018-03-26 12:07:48 -04:00
xfrm
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-04-01 19:49:34 -04:00
compat.c
net: support compat 64-bit time in {s,g}etsockopt
2018-04-27 19:46:06 -04:00
Kconfig
Staging/IIO patches for 4.16-rc1
2018-02-01 09:51:57 -08:00
Makefile
ipx: move Novell IPX protocol support into staging
2017-11-28 13:55:00 +01:00
socket.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2018-04-05 11:56:35 -07:00
sysctl_net.c
net: Drop pernet_operations::async
2018-03-27 13:18:09 -04:00