Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1721206

[PATCH 3.18 01/22] dccp: purge write queue in dccp_destroy_sock()

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 7749d4ff88d31b0be17c8683143135adaaadc6a7 ]

syzkaller reported that DCCP could have a non empty
write queue at dismantle time.

WARNING: CPU: 1 PID: 2953 at net/core/stream.c:199 sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 2953 Comm: syz-executor0 Not tainted 4.13.0-rc4+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 panic+0x1e4/0x417 kernel/panic.c:180
 __warn+0x1c4/0x1d9 kernel/panic.c:541
 report_bug+0x211/0x2d0 lib/bug.c:183
 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190
 do_trap_no_signal arch/x86/kernel/traps.c:224 [inline]
 do_trap+0x260/0x390 arch/x86/kernel/traps.c:273
 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323
 invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846
RIP: 0010:sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199
RSP: 0018:ffff8801d182f108 EFLAGS: 00010297
RAX: ffff8801d1144140 RBX: ffff8801d13cb280 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff85137b00 RDI: ffff8801d13cb280
RBP: ffff8801d182f148 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801d13cb4d0
R13: ffff8801d13cb3b8 R14: ffff8801d13cb300 R15: ffff8801d13cb3b8
 inet_csk_destroy_sock+0x175/0x3f0 net/ipv4/inet_connection_sock.c:835
 dccp_close+0x84d/0xc10 net/dccp/proto.c:1067
 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
 sock_release+0x8d/0x1e0 net/socket.c:597
 sock_close+0x16/0x20 net/socket.c:1126
 __fput+0x327/0x7e0 fs/file_table.c:210
 ____fput+0x15/0x20 fs/file_table.c:246
 task_work_run+0x18a/0x260 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0xa32/0x1b10 kernel/exit.c:865
 do_group_exit+0x149/0x400 kernel/exit.c:969
 get_signal+0x7e8/0x17e0 kernel/signal.c:2330
 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808
 exit_to_usermode_loop+0x21c/0x2d0 arch/x86/entry/common.c:157
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath+0x3a7/0x450 arch/x86/entry/common.c:263

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/proto.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -201,10 +201,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
 	struct dccp_sock *dp = dccp_sk(sk);
 
-	/*
-	 * DCCP doesn't use sk_write_queue, just sk_send_head
-	 * for retransmissions
-	 */
+	__skb_queue_purge(&sk->sk_write_queue);
 	if (sk->sk_send_head != NULL) {
 		kfree_skb(sk->sk_send_head);
 		sk->sk_send_head = NULL;

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/22] 3.18.68-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 19/22] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 05/22] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 20/22] iio: imu: adis16480: Fix acceleration scale factor for adis16480 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 01/22] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 13/22] cifs: Fix df output for users with quota limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 03/22] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 07/22] net_sched: fix order of queue length updates in qdisc_replace() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 22/22] ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 17/22] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 09/22] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 06/22] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 04/22] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 08/22] Input: trackpoint - add new trackpoint firmware ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 3.18 12/22] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 18/22] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 14/22] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 02/22] dccp: defer ccid_hc_tx_delete() at dismantle time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 10/22] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 16/22] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  [PATCH 3.18 21/22] staging: rtl8188eu: add RNX-N150NUB support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:30 +0200
  Re: [PATCH 3.18 00/22] 3.18.68-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-28 21:40 +0200
  Re: [PATCH 3.18 00/22] 3.18.68-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-29 02:10 +0200

csiph-web