Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1172059

[PATCH 3.16.y-ckt 37/71] unix/caif: sk_socket can disappear when state is unlocked

From Luis Henriques <luis.henriques@canonical.com>
Newsgroups linux.kernel
Subject [PATCH 3.16.y-ckt 37/71] unix/caif: sk_socket can disappear when state is unlocked
Date 2015-06-25 12:20 +0200
Message-ID <pFcqe-5Nm-21@gated-at.bofh.it> (permalink)
References <pFcgx-5Bx-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Salyzyn <salyzyn@android.com>

commit b48732e4a48d80ed4a14812f0bab09560846514e upstream.

got a rare NULL pointer dereference in clear_bit

Signed-off-by: Mark Salyzyn <salyzyn@android.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
----
v2: switch to sock_flag(sk, SOCK_DEAD) and added net/caif/caif_socket.c
v3: return -ECONNRESET in upstream caller of wait function for SOCK_DEAD
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/caif/caif_socket.c | 8 ++++++++
 net/unix/af_unix.c     | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 5e078a0b2455..a1a5e852be54 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -330,6 +330,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
 		release_sock(sk);
 		timeo = schedule_timeout(timeo);
 		lock_sock(sk);
+
+		if (sock_flag(sk, SOCK_DEAD))
+			break;
+
 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 	}
 
@@ -374,6 +378,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 		struct sk_buff *skb;
 
 		lock_sock(sk);
+		if (sock_flag(sk, SOCK_DEAD)) {
+			err = -ECONNRESET;
+			goto unlock;
+		}
 		skb = skb_dequeue(&sk->sk_receive_queue);
 		caif_check_flow_release(sk);
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e96884380732..8232118b3f82 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1899,6 +1899,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo,
 		unix_state_unlock(sk);
 		timeo = freezable_schedule_timeout(timeo);
 		unix_state_lock(sk);
+
+		if (sock_flag(sk, SOCK_DEAD))
+			break;
+
 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 	}
 
@@ -1963,6 +1967,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 		struct sk_buff *skb, *last;
 
 		unix_state_lock(sk);
+		if (sock_flag(sk, SOCK_DEAD)) {
+			err = -ECONNRESET;
+			goto unlock;
+		}
 		last = skb = skb_peek(&sk->sk_receive_queue);
 again:
 		if (skb == NULL) {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 63/71] iser-target: release stale iser connections Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 54/71] irqchip: sunxi-nmi: Fix off-by-one error in irq iterator Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 71/71] Revert "tools/vm: fix page-flags build" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 11/71] ALSA: usb-audio: Add mic volume fix quirk for Logitech Quickcam Fusion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 69/71] tracing: Have filter check for balanced ops Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 59/71] mm/memory_hotplug.c: set zone->wait_table to null after freeing it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 66/71] crypto: caam - fix uninitialized state->buf_dma field Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 52/71] ata: ahci_mvebu: Fix wrongly set base address for the MBus window setting Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 60/71] ring-buffer-benchmark: Fix the wrong sched_priority of producer Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 64/71] ALSA: hda - adding a DAC/pin preference map for a HP Envy TS machine Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
  [PATCH 3.16.y-ckt 35/71] net: dp83640: fix broken calibration routine. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 36/71] net: dp83640: reinforce locking rules. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 29/71] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 30/71] thermal: step_wise: Revert optimization Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 20/71] Input: elantech - fix detection of touchpads where the revision matches a known rate Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 37/71] unix/caif: sk_socket can disappear when state is unlocked Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 24/71] USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 21/71] ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 28/71] kconfig: Fix warning "‘jump’ may be used uninitialized" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 23/71] ALSA: usb-audio: fix missing input volume controls in MAYA44 USB(+) Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 31/71] MIPS: KVM: Do not sign extend on unsigned MMIO load Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 38/71] xen/netback: Properly initialize credit_bytes Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 27/71] xfrm: fix a race in xfrm_state_lookup_byspi Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 42/71] bridge: disable softirqs around br_fdb_update to avoid lockup Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 39/71] udp: fix behavior of wrong checksums Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 22/71] ALSA: usb-audio: add MAYA44 USB+ mixer control names Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 41/71] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 40/71] xen: netback: read hotplug script once at start of day. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 43/71] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 44/71] Btrfs: send, add missing check for dead clone root Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 33/71] net: core: Correct an over-stringent device loop detection. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 34/71] net: phy: Allow EEE for all RGMII variants Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 32/71] arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 18/71] x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 48/71] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 25/71] Input: elantech - add new icbody type Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 26/71] MIPS: Fix enabling of DEBUG_STACKOVERFLOW Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
  [PATCH 3.16.y-ckt 45/71] Btrfs: send, don't leave without decrementing clone root's send_progress Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200

csiph-web