From: Willy Tarreau <w@1wt.eu>
To: Ben Hutchings <ben@decadent.org.uk>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Alexander Sverdlin <alexander.sverdlin@nokia.com>,
Neil Horman <nhorman@tuxdriver.com>,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Vlad Yasevich <vyasevich@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: Re: [PATCH 2.6.32 29/62] sctp: Fix race between OOTB responce and route removal
Date: Tue, 15 Sep 2015 09:43:05 +0200 [thread overview]
Message-ID: <20150915074305.GC29318@1wt.eu> (raw)
In-Reply-To: <1442284004.29883.4.camel@decadent.org.uk>
On Tue, Sep 15, 2015 at 03:26:44AM +0100, Ben Hutchings wrote:
> On Sun, 2015-09-13 at 00:56 +0200, Willy Tarreau wrote:
> > 2.6.32-longterm review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
> >
> > [ Upstream commit 29c4afc4e98f4dc0ea9df22c631841f9c220b944 ]
> >
> > There is NULL pointer dereference possible during statistics update if the route
> > used for OOTB responce is removed at unfortunate time. If the route exists when
> > we receive OOTB packet and we finally jump into sctp_packet_transmit() to send
> > ABORT, but in the meantime route is removed under our feet, we take "no_route"
> > path and try to update stats with IP_INC_STATS(sock_net(asoc->base.sk), ...).
> [...]
> > [bwh: Backported to 3.2: sctp alway uses init_net]
> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> [...]
>
> This doesn't make sense in 2.6.32 and it didn't make sense for me to
> apply it to 3.2 either! Since sctp is not using asoc to look up a net
> namespace here, the null pointer doesn't get dereferenced.
Perfect, I'm dropping it now.
Thanks,
Willy
next prev parent reply other threads:[~2015-09-15 7:43 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <08d3b586eb2e764308c3de9ee398a17c@local>
2015-09-12 22:56 ` [PATCH 2.6.32 00/62] 2.6.32.68-longterm review Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 01/62] pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomic Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 02/62] sg_start_req(): make sure that theres not too many elements in iovec Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 03/62] crypto: testmgr - update LZO compression test vectors Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 04/62] TTY: drop driver reference in tty_open fail path Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 05/62] netlink: fix possible spoofing from non-root processes Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 06/62] eCryptfs: Remove buggy and unnecessary write in file name decode routine Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 07/62] HID: fix a couple of off-by-ones Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 08/62] udf: Verify i_size when loading inode Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 09/62] udf: Verify symlink size before loading it Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 11/62] udf: Check path length when reading symlink Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 12/62] udf: Check component length before reading it Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 13/62] Remove repeated loads blocksize Willy Tarreau
2015-09-15 1:42 ` Ben Hutchings
2015-09-15 7:39 ` Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 14/62] udf: Check length of extended attributes and allocation descriptors Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums Willy Tarreau
2015-09-15 1:44 ` Ben Hutchings
2015-09-15 7:41 ` Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 16/62] e1000: add dummy allocator to fix race condition between mtu change and netpoll Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 17/62] powerpc: Fix missing L2 cache size in /sys/devices/system/cpu Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 18/62] s390/hibernate: fix save and restore of kernel text section Willy Tarreau
2015-09-15 2:10 ` Ben Hutchings
2015-09-15 6:09 ` Heiko Carstens
2015-09-15 7:41 ` Willy Tarreau
2015-09-15 7:44 ` Heiko Carstens
2015-09-12 22:56 ` [PATCH 2.6.32 19/62] ptrace: fix race between ptrace_resume() and wait_task_stopped() Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 20/62] memstick: mspro_block: add missing curly braces Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 21/62] md/raid5: dont record new size if resize_stripes fails Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 22/62] powerpc: Align TOC to 256 bytes Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 23/62] jbd2: fix r_count overflows leading to buffer overflow in journal recovery Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 24/62] sd: Disable support for 256 byte/sector disks Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 25/62] lguest: fix out-by-one error in address checking Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 26/62] fs, omfs: add NULL terminator in the end up the token list Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 27/62] x86_64: Fix strnlen_user() to not touch memory after specified maximum Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 28/62] tracing: Have filter check for balanced ops Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 29/62] sctp: Fix race between OOTB responce and route removal Willy Tarreau
2015-09-15 2:26 ` Ben Hutchings
2015-09-15 7:43 ` Willy Tarreau [this message]
2015-09-12 22:56 ` [PATCH 2.6.32 30/62] x86/reboot: Fix a warning message triggered by stop_other_cpus() Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 31/62] include/linux/sched.h: dont use task->pid/tgid in same_thread_group/has_group_leader_pid Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 32/62] __ptrace_may_access() should not deny sub-threads Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 33/62] MIPS: Octeon: Remove udelay() causing huge IRQ latency Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 34/62] MIPS: Fix race condition in lazy cache flushing Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 35/62] MIPS: Fix cpu_has_mips_r2_exec_hazard Willy Tarreau
2015-09-15 3:02 ` Ben Hutchings
2015-09-15 7:43 ` Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 36/62] MIPS: Octeon: Delete override of cpu_has_mips_r2_exec_hazard Willy Tarreau
2015-09-15 11:37 ` Ben Hutchings
2015-09-16 5:17 ` Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 37/62] hrtimer: Allow concurrent hrtimer_start() for self restarting timers Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 38/62] s5h1420: fix a buffer overflow when checking userspace params Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 39/62] cx24116: " Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 40/62] pktgen: adjust spacing in proc file interface output Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 41/62] staging: vt6655: device_rx_srv check sk_buff is NULL Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 42/62] fixing infinite OPEN loop in 4.0 stateid recovery Willy Tarreau
2015-09-14 23:54 ` Kornievskaia, Olga
2015-09-15 5:37 ` Willy Tarreau
[not found] ` <7E69BA76-E3DF-4389-A8C4-F23C9E1FD5CC@netapp.com>
[not found] ` <55D3ECC9-EC69-469F-AD46-EE3818F3D138@netapp.com>
2015-09-16 5:33 ` Willy Tarreau
2015-11-15 0:53 ` [stable] Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount Ben Hutchings
2015-11-15 7:20 ` Willy Tarreau
2015-11-18 23:20 ` Luis Henriques
2015-09-12 22:56 ` [PATCH 2.6.32 43/62] SUNRPC: Fix a memory leak in the backchannel code Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 44/62] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 45/62] ext4: fix race between truncate and __ext4_journalled_writepage() Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 46/62] Disable write buffering on Toshiba ToPIC95 Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 47/62] nfs: increase size of EXCHANGE_ID name string buffer Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 48/62] ext4: call sync_blockdev() before invalidate_bdev() in put_super() Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 49/62] NET: ROSE: Dont dereference NULL neighbour pointer Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 50/62] mm: kmemleak: allow safe memory scanning during kmemleak disabling Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 51/62] tracing/filter: Do not WARN on operand count going below zero Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 52/62] tracing/filter: Do not allow infix to exceed end of string Willy Tarreau
2015-09-12 22:56 ` [PATCH 2.6.32 53/62] fuse: initialize fc->release before calling it Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 54/62] mm: avoid setting up anonymous pages into file mapping Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 55/62] s390/process: fix sfpc inline assembly Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 56/62] libata: increase the timeout when setting transfer mode Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 57/62] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 58/62] dccp: fix auto-loading of dccp(_probe) Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 60/62] dccp: catch failed request_module call in dccp_probe init Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 61/62] dmaengine: fix missing cnt in ?: in dmatest Willy Tarreau
2015-09-12 22:57 ` [PATCH 2.6.32 62/62] ipv6: Fix return of xfrm6_tunnel_rcv() Willy Tarreau
2015-09-12 23:18 ` [PATCH 2.6.32 00/62] 2.6.32.68-longterm review Willy Tarreau
2015-09-15 12:06 ` Ben Hutchings
2015-09-16 5:23 ` Willy Tarreau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150915074305.GC29318@1wt.eu \
--to=w@1wt.eu \
--cc=alexander.sverdlin@nokia.com \
--cc=ben@decadent.org.uk \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=nhorman@tuxdriver.com \
--cc=stable@vger.kernel.org \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).