iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
f8b43c5cf4
linux/net/rxrpc
History
David Howells 06d9532fa6 rxrpc: Fix read-after-free in rxrpc_queue_local() 
rxrpc_queue_local() attempts to queue the local endpoint it is given and
then, if successful, prints a trace line.  The trace line includes the
current usage count - but we're not allowed to look at the local endpoint
at this point as we passed our ref on it to the workqueue.

Fix this by reading the usage count before queuing the work item.

Also fix the reading of local->debug_id for trace lines, which must be done
with the same consideration as reading the usage count.

Fixes: 09d2bf595d ("rxrpc: Add a tracepoint to track rxrpc_local refcounting")
Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
2019-08-14 11:37:51 +01:00
..
af_rxrpc.c rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
ar-internal.h rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
call_accept.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
call_event.c rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
call_object.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
conn_client.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
conn_event.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
conn_object.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
conn_service.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
input.c rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
insecure.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
key.c Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs" 2019-07-10 18:43:43 -07:00
local_event.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
local_object.c rxrpc: Fix read-after-free in rxrpc_queue_local() 2019-08-14 11:37:51 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
misc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
net_ns.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
output.c rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
peer_event.c rxrpc: Fix potential deadlock 2019-07-30 14:42:50 +01:00
peer_object.c rxrpc: Fix potential deadlock 2019-07-30 14:42:50 +01:00
proc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
protocol.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
recvmsg.c rxrpc: Don't bother generating maxSkew in the ACK packet 2019-08-09 15:24:00 +01:00
rxkad.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
security.c Keyrings namespacing 2019-07-08 19:36:47 -07:00
sendmsg.c rxrpc: Fix the lack of notification when sendmsg() fails on a DATA packet 2019-07-30 15:27:59 +01:00
skbuff.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
sysctl.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00