AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity
dev
kernel_optimize_test/net/x25
History
Duoming Zhou 5c94b6205e net/x25: Fix null-ptr-deref caused by x25_disconnect 
[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ]

When the link layer is terminating, x25->neighbour will be set to NULL
in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in
x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is
shown below.

    (Thread 1)                 |  (Thread 2)
x25_link_terminated()          | x25_recvmsg()
 x25_kill_by_neigh()           |  ...
  x25_disconnect()             |  lock_sock(sk)
   ...                         |  ...
   x25->neighbour = NULL //(1) |
   ...                         |  x25->neighbour->extended //(2)

The code sets NULL to x25->neighbour in position (1) and dereferences
x25->neighbour in position (2), which could cause null-ptr-deref bug.

This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize
with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the
sock held by lock_sock() is not NULL, because it is extracted from x25_list
and uses x25_list_lock to synchronize.

Fixes: 4becb7ee5b ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 14:40:30 +02:00
..
af_x25.c net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-04-08 14:40:30 +02:00
Kconfig Replace HTTP links with HTTPS ones: X.25 network layer 2020-07-07 15:44:44 -07:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sysctl_net_x25.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
x25_dev.c net/x25: Fix x25_neigh refcnt leak when receiving frame 2020-04-23 15:39:39 -07:00
x25_facilities.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
x25_forward.c net: x25: convert to list_for_each_entry_safe() 2020-02-16 18:59:42 -08:00
x25_in.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
x25_link.c net: x25: kerneldoc fixes 2020-07-13 17:20:40 -07:00
x25_out.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 41 2019-05-24 17:27:12 +02:00
x25_proc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 41 2019-05-24 17:27:12 +02:00
x25_route.c net: x25: kerneldoc fixes 2020-07-13 17:20:40 -07:00
x25_subr.c net/x25: Fix null-ptr-deref in x25_disconnect 2020-04-28 14:08:59 -07:00
x25_timer.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 41 2019-05-24 17:27:12 +02:00