From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7FCCC3A59F for ; Thu, 29 Aug 2019 18:16:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A69352339E for ; Thu, 29 Aug 2019 18:16:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567102580; bh=/mxg7Hm5UecwTIbCO8OMxcZhGZ67/RLs3uhwn1SB7hM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Fy+hc1fFDUpqh2+Fgq4Utu2fis4i4FUZYSw24wTImrRT63gjNYy5gQz9cNNZhAn2x F3q6zJ8nNNLqHeds7EY957PpD4YqmRdsHFj2hPp8WQJGZqlr6NkSingkfkfDDwxcWp /bemIZC78wL7BcAzoHCU34NQw6knz5Fk6vmBFwzI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729714AbfH2SQT (ORCPT ); Thu, 29 Aug 2019 14:16:19 -0400 Received: from mail.kernel.org ([198.145.29.99]:58034 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728700AbfH2SQG (ORCPT ); Thu, 29 Aug 2019 14:16:06 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C310223403; Thu, 29 Aug 2019 18:16:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1567102565; bh=/mxg7Hm5UecwTIbCO8OMxcZhGZ67/RLs3uhwn1SB7hM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WFsc8UD5tXaIBUrRV47+cRgWu9qCUaXjdyeWuviXchFkH8rQt3tMkX1lDWzxVYbQs UkNrDFmWGF4W7ZkBWyijJdFDb2YsM06VB4lRQlmeKvw23iFZ4sb1rqo/ZJ0dIzo8l5 OuOE7hdTyR7ulKjzUhN/CvY3ZtYEqCW9S9VtHwQo= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: David Howells , syzbot+193e29e9387ea5837f1d@syzkaller.appspotmail.com, Sasha Levin , linux-afs@lists.infradead.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 12/45] rxrpc: Fix local endpoint replacement Date: Thu, 29 Aug 2019 14:15:12 -0400 Message-Id: <20190829181547.8280-12-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190829181547.8280-1-sashal@kernel.org> References: <20190829181547.8280-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: David Howells [ Upstream commit b00df840fb4004b7087940ac5f68801562d0d2de ] When a local endpoint (struct rxrpc_local) ceases to be in use by any AF_RXRPC sockets, it starts the process of being destroyed, but this doesn't cause it to be removed from the namespace endpoint list immediately as tearing it down isn't trivial and can't be done in softirq context, so it gets deferred. If a new socket comes along that wants to bind to the same endpoint, a new rxrpc_local object will be allocated and rxrpc_lookup_local() will use list_replace() to substitute the new one for the old. Then, when the dying object gets to rxrpc_local_destroyer(), it is removed unconditionally from whatever list it is on by calling list_del_init(). However, list_replace() doesn't reset the pointers in the replaced list_head and so the list_del_init() will likely corrupt the local endpoints list. Fix this by using list_replace_init() instead. Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting") Reported-by: syzbot+193e29e9387ea5837f1d@syzkaller.appspotmail.com Signed-off-by: David Howells Signed-off-by: Sasha Levin --- net/rxrpc/local_object.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c index 2182ebfc7df4c..7f82c4e19bd1e 100644 --- a/net/rxrpc/local_object.c +++ b/net/rxrpc/local_object.c @@ -287,7 +287,7 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net, goto sock_error; if (cursor != &rxnet->local_endpoints) - list_replace(cursor, &local->link); + list_replace_init(cursor, &local->link); else list_add_tail(&local->link, cursor); age = "new"; -- 2.20.1