luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity
876a7ae65b
tmp_suning_uos_patched/net/ipv4
History
Eric Dumazet b357a364c5 inet: fix possible panic in reqsk_queue_unlink() 
[ 3897.923145] BUG: unable to handle kernel NULL pointer dereference at
 0000000000000080
[ 3897.931025] IP: [<ffffffffa9f27686>] reqsk_timer_handler+0x1a6/0x243

There is a race when reqsk_timer_handler() and tcp_check_req() call
inet_csk_reqsk_queue_unlink() on the same req at the same time.

Before commit fa76ce7328 ("inet: get rid of central tcp/dccp listener
timer"), listener spinlock was held and race could not happen.

To solve this bug, we change reqsk_queue_unlink() to not assume req
must be found, and we return a status, to conditionally release a
refcount on the request sock.

This also means tcp_check_req() in non fastopen case might or not
consume req refcount, so tcp_v6_hnd_req() & tcp_v4_hnd_req() have
to properly handle this.

(Same remark for dccp_check_req() and its callers)

inet_csk_reqsk_queue_drop() is now too big to be inlined, as it is
called 4 times in tcp and 3 times in dccp.

Fixes: fa76ce7328 ("inet: get rid of central tcp/dccp listener timer")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-04-24 11:39:15 -04:00
..
netfilter netfilter: nf_tables: switch registers to 32 bit addressing 2015-04-13 17:17:29 +02:00
af_inet.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
ah4.c
arp.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
cipso_ipv4.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
datagram.c
devinet.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
esp4.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
fib_frontend.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-06 22:34:15 -04:00
fib_lookup.h
fib_rules.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
fib_semantics.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
fib_trie.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
fou.c fou: avoid missing unlock in failure path 2015-04-16 12:11:19 -04:00
geneve.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-04-14 15:44:14 -04:00
gre_demux.c
gre_offload.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
icmp.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
igmp.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
inet_connection_sock.c inet: fix possible panic in reqsk_queue_unlink() 2015-04-24 11:39:15 -04:00
inet_diag.c inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
inet_fragment.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
inet_hashtables.c tcp/dccp: get rid of central timewait timer 2015-04-13 16:40:05 -04:00
inet_lro.c
inet_timewait_sock.c tcp/dccp: get rid of central timewait timer 2015-04-13 16:40:05 -04:00
inetpeer.c
ip_forward.c ip_forward: Drop frames with attached skb->sk 2015-04-20 14:07:33 -04:00
ip_fragment.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
ip_gre.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
ip_input.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
ip_options.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
ip_output.c net: remove extra newlines 2015-04-07 22:24:37 -04:00
ip_sockglue.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
ip_tunnel_core.c ipv4: ip_tunnel: use net namespace from rtable not socket 2015-04-08 12:09:42 -04:00
ip_tunnel.c udp_tunnel: Pass UDP socket down through udp_tunnel{, 6}_xmit_skb(). 2015-04-07 15:29:08 -04:00
ip_vti.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
ipcomp.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
ipconfig.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
ipip.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
ipmr.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
Kconfig
Makefile
netfilter.c netfilter: Use nf_hook_state in nf_queue_entry. 2015-04-04 12:25:22 -04:00
ping.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
proc.c tcp/dccp: get rid of central timewait timer 2015-04-13 16:40:05 -04:00
protocol.c
raw.c Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-13 18:18:05 -04:00
route.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
syncookies.c tcp: fix ipv4 mapped request socks 2015-03-25 00:57:48 -04:00
sysctl_net_ipv4.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
tcp_bic.c
tcp_cong.c
tcp_cubic.c
tcp_dctcp.c inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
tcp_diag.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
tcp_fastopen.c tcp: RFC7413 option support for Fast Open server 2015-04-07 18:36:39 -04:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
tcp_input.c tcp: add memory barriers to write space paths 2015-04-21 15:57:34 -04:00
tcp_ipv4.c inet: fix possible panic in reqsk_queue_unlink() 2015-04-24 11:39:15 -04:00
tcp_lp.c
tcp_memcontrol.c
tcp_metrics.c tcp: RFC7413 option support for Fast Open client 2015-04-07 18:36:39 -04:00
tcp_minisocks.c inet: fix possible panic in reqsk_queue_unlink() 2015-04-24 11:39:15 -04:00
tcp_offload.c
tcp_output.c tcp: avoid looping in tcp_send_fin() 2015-04-24 11:06:48 -04:00
tcp_probe.c
tcp_scalable.c
tcp_timer.c tcp: RFC7413 option support for Fast Open client 2015-04-07 18:36:39 -04:00
tcp_vegas.c inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
tcp_vegas.h inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
tcp_veno.c
tcp_westwood.c inet_diag: fix access to tcp cc information 2015-04-17 13:28:31 -04:00
tcp_yeah.c
tcp.c tcp: add memory barriers to write space paths 2015-04-21 15:57:34 -04:00
tunnel4.c
udp_diag.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
udp_impl.h
udp_offload.c ipv4: coding style: comparison for inequality with NULL 2015-04-03 12:11:15 -04:00
udp_tunnel.c udp_tunnel: Pass UDP socket down through udp_tunnel{, 6}_xmit_skb(). 2015-04-07 15:29:08 -04:00
udp.c net: remove extra newlines 2015-04-07 22:24:37 -04:00
udplite.c
xfrm4_input.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
xfrm4_mode_beet.c
xfrm4_mode_transport.c
xfrm4_mode_tunnel.c ipv4: hash net ptr into fragmentation bucket selection 2015-03-25 14:07:04 -04:00
xfrm4_output.c netfilter: Pass socket pointer down through okfn(). 2015-04-07 15:25:55 -04:00
xfrm4_policy.c ipv4: coding style: comparison for equality with NULL 2015-04-03 12:11:15 -04:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c