From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AB8JxZrIsift7snTWAJ6HIVuXJr7npS9wwf2HzCG7zAlIrPrDtoIPKsbBRt8yrf+YIiJVADNmi5a ARC-Seal: i=1; a=rsa-sha256; t=1524838186; cv=none; d=google.com; s=arc-20160816; b=qZLRwFTO8f7+lN+6CGSDAPdlf1fzd3xzDQNV19r9NRFbR3AM6Jhnrh3mcjqnG2wRCs 4vyTkFkEGDNbtbCV0qP2+iVjPWFbmKHuYwFCdm3n49H+DkCg6yTkmHEcy62tQZTHNAip pDEBeiUyfSAf5L15+osx9GgAjLKVWuBsYrHepPhzLiHcFtgGSW6z3YBe5rsP6B8Q0ijl RecchFlqM2G9BZfOT/q2TxwW3s03+zqZew3n9X7OQQcf7NFV35MrKJq7RUXdRZNtXLB7 ATLN3VtoUcvCBuMy87z9AERoKzsxi3pfkqewBavphzTuV4LZxcrmuFAdFzP8pxVk8jcJ 1Iuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:dmarc-filter:arc-authentication-results; bh=9ATaLnWVCP0c6UwRU/pkQ67dLv/fRO8JNeoWrIcOuS4=; b=rlygV7tHrxC3DlBPCoZJgQ9g5JgDgW0n4Me1syLuskKVVib8on52hG0a9sLIVMEFJH 0gc6ZW7awr3n8At7pMeRAOWvSpsbE6KCBQRTc6iR2H0gApqRUIarmAsCy6dhxhWFrgNd MdsdYbIKnVTFgfRq5pvuOF3F9qDxkHcoHhI5+vfLoEcLuVr5RKLGrYhV0N7P7KpmvwPl qzkz5DjOrcBLy/DM1spbWg6m++vdk62vfxcy3VHcxmU5SL/AZxmkx5R+cdC3it2VBEOZ ychMGWrhh/AGKqwuQxpI70vUzQYPzFzoraRdmKmBsTna4I7c2g2Q6OJ904J3d+U9gzNq dJRg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of srs0=4/0d=hq=linuxfoundation.org=gregkh@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=SRS0=4/0d=HQ=linuxfoundation.org=gregkh@kernel.org Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of srs0=4/0d=hq=linuxfoundation.org=gregkh@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=SRS0=4/0d=HQ=linuxfoundation.org=gregkh@kernel.org DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4EB0A21864 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linuxfoundation.org Authentication-Results: mail.kernel.org; spf=fail smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+f922284c18ea23a8e457@syzkaller.appspotmail.com, Cong Wang , "David S. Miller" Subject: [PATCH 4.16 14/81] llc: delete timers synchronously in llc_sk_free() Date: Fri, 27 Apr 2018 15:58:16 +0200 Message-Id: <20180427135744.057522417@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180427135743.216853156@linuxfoundation.org> References: <20180427135743.216853156@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1598908119412368139?= X-GMAIL-MSGID: =?utf-8?q?1598908726081706366?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cong Wang [ Upstream commit b905ef9ab90115d001c1658259af4b1c65088779 ] The connection timers of an llc sock could be still flying after we delete them in llc_sk_free(), and even possibly after we free the sock. We could just wait synchronously here in case of troubles. Note, I leave other call paths as they are, since they may not have to wait, at least we can change them to synchronously when needed. Also, move the code to net/llc/llc_conn.c, which is apparently a better place. Reported-by: Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/llc_conn.h | 1 + net/llc/llc_c_ac.c | 9 +-------- net/llc/llc_conn.c | 22 +++++++++++++++++++++- 3 files changed, 23 insertions(+), 9 deletions(-) --- a/include/net/llc_conn.h +++ b/include/net/llc_conn.h @@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type( struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct proto *prot, int kern); +void llc_sk_stop_all_timers(struct sock *sk, bool sync); void llc_sk_free(struct sock *sk); void llc_sk_reset(struct sock *sk); --- a/net/llc/llc_c_ac.c +++ b/net/llc/llc_c_ac.c @@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct s int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb) { - struct llc_sock *llc = llc_sk(sk); - - del_timer(&llc->pf_cycle_timer.timer); - del_timer(&llc->ack_timer.timer); - del_timer(&llc->rej_sent_timer.timer); - del_timer(&llc->busy_state_timer.timer); - llc->ack_must_be_send = 0; - llc->ack_pf = 0; + llc_sk_stop_all_timers(sk, false); return 0; } --- a/net/llc/llc_conn.c +++ b/net/llc/llc_conn.c @@ -961,6 +961,26 @@ out: return sk; } +void llc_sk_stop_all_timers(struct sock *sk, bool sync) +{ + struct llc_sock *llc = llc_sk(sk); + + if (sync) { + del_timer_sync(&llc->pf_cycle_timer.timer); + del_timer_sync(&llc->ack_timer.timer); + del_timer_sync(&llc->rej_sent_timer.timer); + del_timer_sync(&llc->busy_state_timer.timer); + } else { + del_timer(&llc->pf_cycle_timer.timer); + del_timer(&llc->ack_timer.timer); + del_timer(&llc->rej_sent_timer.timer); + del_timer(&llc->busy_state_timer.timer); + } + + llc->ack_must_be_send = 0; + llc->ack_pf = 0; +} + /** * llc_sk_free - Frees a LLC socket * @sk - socket to free @@ -973,7 +993,7 @@ void llc_sk_free(struct sock *sk) llc->state = LLC_CONN_OUT_OF_SVC; /* Stop all (possibly) running timers */ - llc_conn_ac_stop_all_timers(sk, NULL); + llc_sk_stop_all_timers(sk, true); #ifdef DEBUG_LLC_CONN_ALLOC printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__, skb_queue_len(&llc->pdu_unack_q),