Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1624313
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() |
| Date | 2017-04-16 13:10 +0200 |
| Message-ID | <twQe5-2WB-17@gated-at.bofh.it> (permalink) |
| References | <twQ4p-2E7-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit d5afb6f9b6bb2c57bd0c05e76e12489dc0d037d9 upstream.
The code where sk_clone() came from created a new socket and locked it,
but then, on the error path didn't unlock it.
This problem stayed there for a long while, till b0691c8ee7c2 ("net:
Unlock sock before calling sk_free()") fixed it, but unfortunately the
callers of sk_clone() (now sk_clone_locked()) were not audited and the
one in dccp_create_openreq_child() remained.
Now in the age of the syskaller fuzzer, this was finally uncovered, as
reported by Dmitry:
---- 8< ----
I've got the following report while running syzkaller fuzzer on
86292b33d4b7 ("Merge branch 'akpm' (patches from Andrew)")
[ BUG: held lock freed! ]
4.10.0+ #234 Not tainted
-------------------------
syz-executor6/6898 is freeing memory
ffff88006286cac0-ffff88006286d3b7, with a lock still held there!
(slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
include/linux/spinlock.h:299 [inline]
(slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504
5 locks held by syz-executor6/6898:
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>] lock_sock
include/net/sock.h:1460 [inline]
#0: (sk_lock-AF_INET6){+.+.+.}, at: [<ffffffff839a34b4>]
inet_stream_connect+0x44/0xa0 net/ipv4/af_inet.c:681
#1: (rcu_read_lock){......}, at: [<ffffffff83bc1c2a>]
inet6_csk_xmit+0x12a/0x5d0 net/ipv6/inet6_connection_sock.c:126
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_unlink
include/linux/skbuff.h:1767 [inline]
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>] __skb_dequeue
include/linux/skbuff.h:1783 [inline]
#2: (rcu_read_lock){......}, at: [<ffffffff8369b424>]
process_backlog+0x264/0x730 net/core/dev.c:4835
#3: (rcu_read_lock){......}, at: [<ffffffff83aeb5c0>]
ip6_input_finish+0x0/0x1700 net/ipv6/ip6_input.c:59
#4: (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>] spin_lock
include/linux/spinlock.h:299 [inline]
#4: (slock-AF_INET6){+.-...}, at: [<ffffffff8362c2c9>]
sk_clone_lock+0x3d9/0x12c0 net/core/sock.c:1504
Fix it just like was done by b0691c8ee7c2 ("net: Unlock sock before calling
sk_free()").
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170301153510.GE15145@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/minisocks.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -135,6 +135,7 @@ struct sock *dccp_create_openreq_child(s
/* It is still raw copy of parent, so invalidate
* destructor and make plain sk_free() */
newsk->sk_destruct = NULL;
+ bh_unlock_sock(newsk);
sk_free(newsk);
return NULL;
}
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 099/145] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 032/145] selinux: fix off-by-one in setprocattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 140/145] tcp: fix various issues for sockets morphing to listen state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 041/145] [PATCH 087/760] net: pktgen: remove rcu locking in pktgen_change_name() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 084/145] usb: dwc3: gadget: make Set Endpoint Configuration macros safe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 143/145] uapi: fix linux/packet_diag.h userspace compilation error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:00 +0200
[PATCH 3.18 125/145] KVM: s390: Fix guest migration for huge guests resulting in panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 104/145] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 095/145] padata: avoid race in reordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 083/145] usb: gadget: dummy_hcd: clear usb_gadget region before registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 129/145] USB: uss720: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 132/145] USB: wusbcore: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 109/145] dccp: Unlock sock before calling sk_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 141/145] net: fix socket refcounting in skb_complete_wifi_ack() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 101/145] cpmac: remove hopeless #warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 110/145] net/packet: fix overflow in check for priv area size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 117/145] crypto: cryptd - Assign statesize properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 098/145] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 078/145] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 123/145] s390: make setup_randomness work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 075/145] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 130/145] USB: lvtest: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 137/145] MIPS: DEC: Avoid la pseudo-instruction in delay slots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 139/145] libceph: dont set weight to IN when OSD is destroyed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 111/145] usb: hub: Wait for connection to be reestablished after port reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 094/145] dm: flush queued bios when process blocks to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 082/145] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 135/145] MIPS: ip27: Disable qlge driver in defconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 091/145] USB: serial: io_ti: fix NULL-deref in interrupt callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 118/145] crypto: mcryptd - Fix load failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 122/145] s390: TASK_SIZE for kernel threads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 115/145] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 106/145] ipv4: mask tos for input route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 134/145] USB: fix linked-list corruption in rh_call_control() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 102/145] tracing: Add #undef to fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 136/145] MIPS: ip22: Fix ip28 build for modern gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:10 +0200
[PATCH 3.18 052/145] drivers: staging: nvec: remove bogus reset command for PS/2 interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 042/145] [PATCH 091/760] ipv4: disable BH in set_ping_group_range() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 090/145] USB: iowarrior: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 035/145] [PATCH 074/760] tcp: fix a compile error in DBGUNDO() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 060/145] lib/vsprintf.c: improve sanity check in vsnprintf() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 030/145] pwm: Unexport children before chip removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 068/145] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 071/145] Bluetooth: Add another AR3012 04ca:3018 device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 057/145] net/llc: avoid BUG_ON() in skb_orphan() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 087/145] USB: serial: safe_serial: fix information leak in completion handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 070/145] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 089/145] USB: iowarrior: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 046/145] [PATCH 083/760] netlink: do not enter direct reclaim from netlink_dump() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 065/145] xfrm: policy: init locks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 074/145] USB: serial: digi_acceleport: fix OOB-event processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 076/145] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 007/145] ipv4: keep skb->dst around in presence of IP options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 050/145] coredump: fix unfreezable coredumping task Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 043/145] [PATCH 093/760] net: sctp, forbid negative length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 072/145] IB/ipoib: Fix deadlock between rmmod and set_mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 069/145] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 047/145] ASoC: cs4270: fix DAPM stream name mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 054/145] USB: cdc-acm: fix TIOCMIWAIT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 036/145] [PATCH 075/760] ip6_gre: fix flowi6_proto value in ip6gre_xmit_other() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 005/145] tcp: fix 0 divide in __tcp_select_window() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 085/145] usb: gadget: function: f_fs: pass companion descriptor along Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 063/145] cancel the setfilesize transation when io error happen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 051/145] staging: iio: ad5933: avoid uninitialized variable in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 064/145] raid10: increment write counter after bio is split Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 059/145] net: socket: fix recvmmsg not returning error from sock_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 037/145] [PATCH 076/760] ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 049/145] swapfile: fix memory corruption via malformed swapfile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 062/145] tty: n_hdlc: get rid of racy n_hdlc.tbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:20 +0200
[PATCH 3.18 028/145] smc91x: avoid self-comparison warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 015/145] [PATCH 084/760] ipv6: tcp: restore IP6CB for pktoptions skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 012/145] ping: fix a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 020/145] tcp: fix overflow in __tcp_retransmit_skb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 019/145] usb: chipidea: move the lock initialization to core file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 002/145] can: Fix kernel panic at security_sock_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 031/145] HID: usbhid: add ATEN CS962 to list of quirky devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 027/145] drm/exynos: fix error handling in exynos_drm_subdrv_open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 033/145] fbdev: color map copying bounds checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
[PATCH 3.18 023/145] ALSA: usb-audio: Add quirk for Syntek STK1160 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-16 13:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-17 01:40 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 09:00 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Amit Pundir <amit.pundir@linaro.org> - 2017-04-17 10:10 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-17 10:30 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-17 20:20 +0200
Re: [PATCH 3.18 000/145] 3.18.49-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-18 07:00 +0200
csiph-web