1
0
Fork 0
alistair23-linux/net/rxrpc
David Howells 269a3c472a rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
[ Upstream commit 5273a191dc ]

When a call is disconnected, the connection pointer from the call is
cleared to make sure it isn't used again and to prevent further attempted
transmission for the call.  Unfortunately, there might be a daemon trying
to use it at the same time to transmit a packet.

Fix this by keeping call->conn set, but setting a flag on the call to
indicate disconnection instead.

Remove also the bits in the transmission functions where the conn pointer is
checked and a ref taken under spinlock as this is now redundant.

Fixes: 8d94aa381d ("rxrpc: Calls shouldn't hold socket refs")
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-02-11 04:35:05 -08:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
af_rxrpc.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-02-11 04:35:05 -08:00
ar-internal.h rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-11 04:35:05 -08:00
call_accept.c rxrpc: Fix missing security check on incoming calls 2020-01-17 19:49:05 +01:00
call_event.c rxrpc: Use the tx-phase skb flag to simplify tracing 2019-08-27 10:04:18 +01:00
call_object.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-11 04:35:05 -08:00
conn_client.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-11 04:35:05 -08:00
conn_event.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-02-11 04:35:05 -08:00
conn_object.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-11 04:35:05 -08:00
conn_service.c rxrpc: Fix missing security check on incoming calls 2020-01-17 19:49:05 +01:00
input.c rxrpc: Fix insufficient receive notification generation 2020-02-11 04:35:05 -08:00
insecure.c rxrpc: Fix -Wframe-larger-than= warnings from on-stack crypto 2019-07-30 10:32:35 -07:00
key.c Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs" 2019-07-10 18:43:43 -07:00
local_event.c rxrpc: Use the tx-phase skb flag to simplify tracing 2019-08-27 10:04:18 +01:00
local_object.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-02-11 04:35:05 -08:00
misc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
net_ns.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00
output.c rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect 2020-02-11 04:35:05 -08:00
peer_event.c rxrpc: Fix missing active use pinning of rxrpc_local object 2020-02-11 04:35:05 -08:00
peer_object.c rxrpc: rxrpc_peer needs to hold a ref on the rxrpc_local record 2019-10-07 11:05:05 +01:00
proc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
protocol.h rxrpc: Improve jumbo packet counting 2019-08-27 09:48:37 +01:00
recvmsg.c rxrpc: Fix handling of last subpacket of jumbo packet 2019-10-31 12:23:09 -07:00
rxkad.c rxrpc: Fix missing security check on incoming calls 2020-01-17 19:49:05 +01:00
security.c rxrpc: Fix missing security check on incoming calls 2020-01-17 19:49:05 +01:00
sendmsg.c rxrpc: Fix call crypto state cleanup 2019-10-07 11:05:05 +01:00
skbuff.c rxrpc: Use skb_unshare() rather than skb_cow_data() 2019-08-27 10:13:46 +01:00
sysctl.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
utils.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36 2019-05-24 17:27:11 +02:00