Eric Dumazet b357a364c5 inet: fix possible panic in reqsk_queue_unlink() ... [ 3897.923145] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [ 3897.931025] IP: [<ffffffffa9f27686>] reqsk_timer_handler+0x1a6/0x243 There is a race when reqsk_timer_handler() and tcp_check_req() call inet_csk_reqsk_queue_unlink() on the same req at the same time. Before commit fa76ce7328 ("inet: get rid of central tcp/dccp listener timer"), listener spinlock was held and race could not happen. To solve this bug, we change reqsk_queue_unlink() to not assume req must be found, and we return a status, to conditionally release a refcount on the request sock. This also means tcp_check_req() in non fastopen case might or not consume req refcount, so tcp_v6_hnd_req() & tcp_v4_hnd_req() have to properly handle this. (Same remark for dccp_check_req() and its callers) inet_csk_reqsk_queue_drop() is now too big to be inlined, as it is called 4 times in tcp and 3 times in dccp. Fixes: fa76ce7328 ("inet: get rid of central tcp/dccp listener timer") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-04-24 11:39:15 -04:00
..
ccids
ackvec.c	dccp: replace min/casting by min_t	2014-11-18 15:26:32 -05:00
ackvec.h
ccid.c
ccid.h
dccp.h	ipv4: dccp: handle ICMP messages on DCCP_NEW_SYN_RECV request sockets	2015-03-23 16:52:26 -04:00
diag.c	inet_diag: add const to inet_diag_req_v2	2015-03-10 13:45:28 -04:00
feat.c	dccp: kerneldoc warning fixes	2014-11-18 15:26:31 -05:00
feat.h
input.c	dccp: spelling s/reseting/resetting	2014-11-18 15:26:32 -05:00
ipv4.c	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
ipv6.c	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
ipv6.h
Kconfig
Makefile
minisocks.c	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
options.c
output.c
probe.c	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
proto.c	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
qpolicy.c
sysctl.c
timer.c	inet: get rid of central tcp/dccp listener timer	2015-03-20 12:40:25 -04:00