From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Eric Dumazet <edumazet@google.com>,
Sasha Levin <levinsasha928@gmail.com>,
Samuel Ortiz <sameo@linux.intel.com>
Subject: [ 07/48] NFC: Return from rawsock_release when sk is NULL
Date: Mon, 09 Jul 2012 15:31:23 +0100 [thread overview]
Message-ID: <20120709143117.646591387@decadent.org.uk> (raw)
In-Reply-To: <20120709143116.348975190@decadent.org.uk>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 03e934f620101ca2cfc9383bd76172dd3e1f8567 upstream.
Sasha Levin reported following panic :
[ 2136.383310] BUG: unable to handle kernel NULL pointer dereference at
00000000000003b0
[ 2136.384022] IP: [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0
[ 2136.384022] PGD 131c4067 PUD 11c0c067 PMD 0
[ 2136.388106] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 2136.388106] CPU 1
[ 2136.388106] Pid: 24855, comm: trinity-child1 Tainted: G W
3.5.0-rc2-sasha-00015-g7b268f7 #374
[ 2136.388106] RIP: 0010:[<ffffffff8114e400>] [<ffffffff8114e400>]
__lock_acquire+0xc0/0x4b0
[ 2136.388106] RSP: 0018:ffff8800130b3ca8 EFLAGS: 00010046
[ 2136.388106] RAX: 0000000000000086 RBX: ffff88001186b000 RCX:
0000000000000000
[ 2136.388106] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
0000000000000000
[ 2136.388106] RBP: ffff8800130b3d08 R08: 0000000000000001 R09:
0000000000000000
[ 2136.388106] R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000002
[ 2136.388106] R13: 00000000000003b0 R14: 0000000000000000 R15:
0000000000000000
[ 2136.388106] FS: 00007fa5b1bd4700(0000) GS:ffff88001b800000(0000)
knlGS:0000000000000000
[ 2136.388106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2136.388106] CR2: 00000000000003b0 CR3: 0000000011d1f000 CR4:
00000000000406e0
[ 2136.388106] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2136.388106] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
0000000000000400
[ 2136.388106] Process trinity-child1 (pid: 24855, threadinfo
ffff8800130b2000, task ffff88001186b000)
[ 2136.388106] Stack:
[ 2136.388106] ffff8800130b3cd8 ffffffff81121785 ffffffff81236774
000080d000000001
[ 2136.388106] ffff88001b9d6c00 00000000001d6c00 ffffffff130b3d08
ffff88001186b000
[ 2136.388106] 0000000000000000 0000000000000002 0000000000000000
0000000000000000
[ 2136.388106] Call Trace:
[ 2136.388106] [<ffffffff81121785>] ? sched_clock_local+0x25/0x90
[ 2136.388106] [<ffffffff81236774>] ? get_empty_filp+0x74/0x220
[ 2136.388106] [<ffffffff8114e97a>] lock_acquire+0x18a/0x1e0
[ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff837c0ef0>] _raw_write_lock_bh+0x40/0x80
[ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff836b37df>] rawsock_release+0x4f/0xa0
[ 2136.388106] [<ffffffff8321cfe8>] sock_release+0x18/0x70
[ 2136.388106] [<ffffffff8321d069>] sock_close+0x29/0x30
[ 2136.388106] [<ffffffff81236bca>] __fput+0x11a/0x2c0
[ 2136.388106] [<ffffffff81236d85>] fput+0x15/0x20
[ 2136.388106] [<ffffffff8321de34>] sys_accept4+0x1b4/0x200
[ 2136.388106] [<ffffffff837c165c>] ? _raw_spin_unlock_irq+0x4c/0x80
[ 2136.388106] [<ffffffff837c1669>] ? _raw_spin_unlock_irq+0x59/0x80
[ 2136.388106] [<ffffffff837c2565>] ? sysret_check+0x22/0x5d
[ 2136.388106] [<ffffffff8321de8b>] sys_accept+0xb/0x10
[ 2136.388106] [<ffffffff837c2539>] system_call_fastpath+0x16/0x1b
[ 2136.388106] Code: ec 04 00 0f 85 ea 03 00 00 be d5 0b 00 00 48 c7 c7
8a c1 40 84 e8 b1 a5 f8 ff 31 c0 e9 d4 03 00 00 66 2e 0f 1f 84 00 00 00
00 00 <49> 81 7d 00 60 73 5e 85 b8 01 00 00 00 44 0f 44 e0 83 fe 01 77
[ 2136.388106] RIP [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0
[ 2136.388106] RSP <ffff8800130b3ca8>
[ 2136.388106] CR2: 00000000000003b0
[ 2136.388106] ---[ end trace 6d450e935ee18982 ]---
[ 2136.388106] Kernel panic - not syncing: Fatal exception in interrupt
rawsock_release() should test if sock->sk is NULL before calling
sock_orphan()/sock_put()
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
[bwh: Backported to 3.2: keep using nfc_dbg(), not pr_debug()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/nfc/rawsock.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -52,7 +52,10 @@ static int rawsock_release(struct socket
{
struct sock *sk = sock->sk;
- nfc_dbg("sock=%p", sock);
+ nfc_dbg("sock=%p sk=%p", sock, sk);
+
+ if (!sk)
+ return 0;
sock_orphan(sk);
sock_put(sk);
next prev parent reply other threads:[~2012-07-09 14:31 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-09 14:31 [ 00/48] 3.2.23-stable review Ben Hutchings
2012-07-09 14:31 ` [ 01/48] splice: fix racy pipe->buffers uses Ben Hutchings
2012-07-09 14:31 ` [ 02/48] umem: fix up unplugging Ben Hutchings
2012-07-09 14:31 ` [ 03/48] mwifiex: fix 11n rx packet drop issue Ben Hutchings
2012-07-09 14:31 ` [ 04/48] mwifiex: fix WPS eapol handshake failure Ben Hutchings
2012-07-09 14:31 ` [ 05/48] NFC: Prevent multiple buffer overflows in NCI Ben Hutchings
2012-07-09 14:31 ` [ 06/48] ath9k: fix dynamic WEP related regression Ben Hutchings
2012-07-09 14:31 ` Ben Hutchings [this message]
2012-07-09 14:31 ` [ 08/48] rtlwifi: rtl8192cu: New USB IDs Ben Hutchings
2012-07-09 14:31 ` [ 09/48] ath9k: enable serialize_regmode for non-PCIE AR9287 Ben Hutchings
2012-07-09 14:31 ` [ 10/48] mac80211: correct behaviour on unrecognised action frames Ben Hutchings
2012-07-09 14:31 ` [ 11/48] ASoC: tlv320aic3x: Fix codec pll configure bug Ben Hutchings
2012-07-09 14:31 ` [ 12/48] powerpc/xmon: Use cpumask iterator to avoid warning Ben Hutchings
2012-07-09 14:31 ` [ 13/48] powerpc/kvm: sldi should be sld Ben Hutchings
2012-07-09 14:31 ` [ 14/48] md/raid10: Dont try to recovery unmatched (and unused) chunks Ben Hutchings
2012-07-09 14:31 ` [ 15/48] md/raid5: Do not add data_offset before call to is_badblock Ben Hutchings
2012-07-09 14:31 ` [ 16/48] md/raid5: In ops_run_io, inc nr_pending before calling md_wait_for_blocked_rdev Ben Hutchings
2012-07-09 14:31 ` [ 17/48] md/raid10: fix failure when trying to repair a read error Ben Hutchings
2012-07-09 14:31 ` [ 18/48] drm/i915: kick any firmware framebuffers before claiming the gtt Ben Hutchings
2012-07-09 14:31 ` [ 19/48] dm persistent data: fix shadow_info_leak on dm_tm_destroy Ben Hutchings
2012-07-09 14:31 ` [ 20/48] dm persistent data: handle space map checker creation failure Ben Hutchings
2012-07-09 14:31 ` [ 21/48] dm persistent data: fix allocation failure in space map checker init Ben Hutchings
2012-07-09 14:31 ` [ 22/48] ALSA: hda - Fix power-map regression for HP dv6 & co Ben Hutchings
2012-07-09 14:31 ` [ 23/48] tracing: change CPU ring buffer state from tracing_cpumask Ben Hutchings
2012-07-09 14:31 ` [ 24/48] mwifiex: fix wrong return values in add_virtual_intf() error cases Ben Hutchings
2012-07-09 14:31 ` [ 25/48] udf: Use ret instead of abusing i in udf_load_logicalvol() Ben Hutchings
2012-07-09 14:31 ` [ 26/48] udf: Avoid run away loop when partition table length is corrupted Ben Hutchings
2012-07-10 15:52 ` Ben Hutchings
2012-07-10 16:04 ` Jan Kara
2012-07-11 1:36 ` Ben Hutchings
2012-07-09 14:31 ` [ 27/48] udf: Fortify loading of sparing table Ben Hutchings
2012-07-09 14:31 ` [ 28/48] ARM: fix rcu stalls on SMP platforms Ben Hutchings
2012-07-09 14:31 ` [ 29/48] net: sock: validate data_len before allocating skb in sock_alloc_send_pskb() Ben Hutchings
2012-07-09 14:31 ` [ 30/48] cipso: handle CIPSO options correctly when NetLabel is disabled Ben Hutchings
2012-07-09 14:31 ` [ 31/48] net: l2tp_eth: fix kernel panic on rmmod l2tp_eth Ben Hutchings
2012-07-09 14:31 ` [ 32/48] l2tp: fix a race in l2tp_ip_sendmsg() Ben Hutchings
2012-07-09 14:31 ` [ 33/48] sky2: fix checksum bit management on some chips Ben Hutchings
2012-07-09 14:31 ` [ 34/48] be2net: fix a race in be_xmit() Ben Hutchings
2012-07-09 14:31 ` [ 35/48] dummy: fix rcu_sched self-detected stalls Ben Hutchings
2012-07-09 23:39 ` Herton Ronaldo Krzesinski
2012-07-09 23:47 ` Ben Hutchings
2012-07-09 23:49 ` David Miller
2012-07-10 0:20 ` Ben Hutchings
2012-07-09 14:31 ` [ 36/48] bonding: Fix corrupted queue_mapping Ben Hutchings
2012-07-09 14:31 ` [ 37/48] ethtool: allow ETHTOOL_GSSET_INFO for users Ben Hutchings
2012-07-09 14:31 ` [ 38/48] netpoll: fix netpoll_send_udp() bugs Ben Hutchings
2012-07-09 14:31 ` [ 39/48] ipv6: Move ipv6 proc file registration to end of init order Ben Hutchings
2012-07-09 14:31 ` [ 40/48] bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2) Ben Hutchings
2012-07-09 14:31 ` [ 41/48] Btrfs: run delayed directory updates during log replay Ben Hutchings
2012-07-09 14:31 ` [ 42/48] cifs: when server doesnt set CAP_LARGE_READ_X, cap default rsize at MaxBufferSize Ben Hutchings
2012-07-09 14:31 ` [ 43/48] ocfs2: clear unaligned io flag when dio fails Ben Hutchings
2012-07-09 14:32 ` [ 44/48] aio: make kiocb->private NUll in init_sync_kiocb() Ben Hutchings
2012-07-09 14:32 ` [ 45/48] mtd: cafe_nand: fix an & vs | mistake Ben Hutchings
2012-07-09 14:32 ` [ 46/48] mm: Hold a file reference in madvise_remove Ben Hutchings
2012-07-09 14:32 ` [ 47/48] tcm_fc: Resolve suspicious RCU usage warnings Ben Hutchings
2012-07-09 14:32 ` [ 48/48] vfs: make O_PATH file descriptors usable for fchdir() Ben Hutchings
2012-07-11 1:33 ` [ 00/48] 3.2.23-stable review Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120709143117.646591387@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=edumazet@google.com \
--cc=levinsasha928@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sameo@linux.intel.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).