From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10975CA9EB9 for ; Sat, 26 Oct 2019 13:27:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D222B214DA for ; Sat, 26 Oct 2019 13:27:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572096458; bh=DPX5Xd1J8hqUFZgtTHhYIe6T0e8+tX+LXmSYcR1K0nE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uNFX9dNqmjhlPifb1jPWdz2o/g9EAtSYQ2ES8wzY7Wy1VgUaG3E36gfaxbKVdPj4f 0gcXeyOu90SkEXlZX7lEWd1VdKXLG3tYAOhed0Qj+7fiRlKFg/ksMLOVkpd32XSPDS 1aiZ9oXCRHpx7CEgrd0Mw9o64Bhos6DQ0b0uHCzU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728999AbfJZNV3 (ORCPT ); Sat, 26 Oct 2019 09:21:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:43054 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727725AbfJZNVS (ORCPT ); Sat, 26 Oct 2019 09:21:18 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C8B1720867; Sat, 26 Oct 2019 13:21:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572096077; bh=DPX5Xd1J8hqUFZgtTHhYIe6T0e8+tX+LXmSYcR1K0nE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eLNTm4MdYQyo1wBRyXY0+vBtK06vyNkjWwwlfiVil4Ap/FAEVClyOli+2gR87iZ3K 8OMFFjjMrSDW7tvsjvJtMRfL8TIC8qK1BtZ8TnhaXd14UuOH53Fl2te/Dsr3SNeYKL sR7vfZqUiMdHY7ySfLK/mfgpHqdkNPd3+Lw5lCpk= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: David Howells , syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com, Sasha Levin , linux-afs@lists.infradead.org, netdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.14 06/33] rxrpc: Fix call ref leak Date: Sat, 26 Oct 2019 09:20:43 -0400 Message-Id: <20191026132110.4026-6-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191026132110.4026-1-sashal@kernel.org> References: <20191026132110.4026-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: David Howells [ Upstream commit c48fc11b69e95007109206311b0187a3090591f3 ] When sendmsg() finds a call to continue on with, if the call is in an inappropriate state, it doesn't release the ref it just got on that call before returning an error. This causes the following symptom to show up with kasan: BUG: KASAN: use-after-free in rxrpc_send_keepalive+0x8a2/0x940 net/rxrpc/output.c:635 Read of size 8 at addr ffff888064219698 by task kworker/0:3/11077 where line 635 is: whdr.epoch = htonl(peer->local->rxnet->epoch); The local endpoint (which cannot be pinned by the call) has been released, but not the peer (which is pinned by the call). Fix this by releasing the call in the error path. Fixes: 37411cad633f ("rxrpc: Fix potential NULL-pointer exception") Reported-by: syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com Signed-off-by: David Howells Signed-off-by: Sasha Levin --- net/rxrpc/sendmsg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c index 016e293681b8c..a980b49d7a4f8 100644 --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -586,6 +586,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) case RXRPC_CALL_SERVER_PREALLOC: case RXRPC_CALL_SERVER_SECURING: case RXRPC_CALL_SERVER_ACCEPTING: + rxrpc_put_call(call, rxrpc_call_put); ret = -EBUSY; goto error_release_sock; default: -- 2.20.1