Tommi Rantala 575650b656 tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path ... [ Upstream commit 642a8439dd ] Calling tipc_mon_delete() before the monitor has been created will oops. This can happen in tipc_enable_bearer() error path if tipc_disc_create() fails. [ 48.589074] BUG: unable to handle kernel paging request at 0000000000001008 [ 48.590266] IP: tipc_mon_delete+0xea/0x270 [tipc] [ 48.591223] PGD 1e60c5067 P4D 1e60c5067 PUD 1eb0cf067 PMD 0 [ 48.592230] Oops: 0000 [#1] SMP KASAN [ 48.595610] CPU: 5 PID: 1199 Comm: tipc Tainted: G B 4.15.0-rc4-pc64-dirty #5 [ 48.597176] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 [ 48.598489] RIP: 0010:tipc_mon_delete+0xea/0x270 [tipc] [ 48.599347] RSP: 0018:ffff8801d827f668 EFLAGS: 00010282 [ 48.600705] RAX: ffff8801ee813f00 RBX: 0000000000000204 RCX: 0000000000000000 [ 48.602183] RDX: 1ffffffff1de6a75 RSI: 0000000000000297 RDI: 0000000000000297 [ 48.604373] RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff1dd1533 [ 48.605607] R10: ffffffff8eafbb05 R11: fffffbfff1dd1534 R12: 0000000000000050 [ 48.607082] R13: dead000000000200 R14: ffffffff8e73f310 R15: 0000000000001020 [ 48.608228] FS: 00007fc686484800(0000) GS:ffff8801f5540000(0000) knlGS:0000000000000000 [ 48.610189] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 48.611459] CR2: 0000000000001008 CR3: 00000001dda70002 CR4: 00000000003606e0 [ 48.612759] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.613831] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 48.615038] Call Trace: [ 48.615635] tipc_enable_bearer+0x415/0x5e0 [tipc] [ 48.620623] tipc_nl_bearer_enable+0x1ab/0x200 [tipc] [ 48.625118] genl_family_rcv_msg+0x36b/0x570 [ 48.631233] genl_rcv_msg+0x5a/0xa0 [ 48.631867] netlink_rcv_skb+0x1cc/0x220 [ 48.636373] genl_rcv+0x24/0x40 [ 48.637306] netlink_unicast+0x29c/0x350 [ 48.639664] netlink_sendmsg+0x439/0x590 [ 48.642014] SYSC_sendto+0x199/0x250 [ 48.649912] do_syscall_64+0xfd/0x2c0 [ 48.650651] entry_SYSCALL64_slow_path+0x25/0x25 [ 48.651843] RIP: 0033:0x7fc6859848e3 [ 48.652539] RSP: 002b:00007ffd25dff938 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 48.654003] RAX: ffffffffffffffda RBX: 00007ffd25dff990 RCX: 00007fc6859848e3 [ 48.655303] RDX: 0000000000000054 RSI: 00007ffd25dff990 RDI: 0000000000000003 [ 48.656512] RBP: 00007ffd25dff980 R08: 00007fc685c35fc0 R09: 000000000000000c [ 48.657697] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000d13010 [ 48.658840] R13: 00007ffd25e009c0 R14: 0000000000000000 R15: 0000000000000000 [ 48.662972] RIP: tipc_mon_delete+0xea/0x270 [tipc] RSP: ffff8801d827f668 [ 48.664073] CR2: 0000000000001008 [ 48.664576] ---[ end trace e811818d54d5ce88 ]--- Acked-by: Ying Xue <ying.xue@windriver.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-03 10:24:30 +01:00
..
Kconfig	tipc: add ip/udp media type	2015-03-05 22:08:42 -05:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
addr.c	tipc: simplify include dependencies	2015-05-14 12:24:45 -04:00
addr.h	tipc: introduce constants for tipc address validation	2016-07-26 14:26:42 -07:00
bcast.c	tipc: correct initialization of skb list	2017-10-08 21:13:23 -07:00
bcast.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
bearer.c	tipc: error path leak fixes in tipc_enable_bearer()	2018-03-03 10:24:30 +01:00
bearer.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
core.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
core.h	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
discover.c	tipc: allocate user memory with GFP_KERNEL flag	2017-01-16 13:31:53 -05:00
discover.h	tipc: eliminate buffer leak in bearer layer	2016-04-07 17:00:13 -04:00
eth_media.c	tipc: make media address offset a common define	2015-02-27 18:18:48 -05:00
ib_media.c	tipc: rename media/msg related definitions	2015-02-27 18:18:48 -05:00
link.c	tipc: don't reset stale broadcast send link	2017-08-21 13:37:45 -07:00
link.h	tipc: transfer broadcast nacks in link state messages	2016-09-02 17:10:24 -07:00
monitor.c	tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path	2018-03-03 10:24:30 +01:00
monitor.h	tipc: dump monitor attributes	2016-07-26 14:26:42 -07:00
msg.c	tipc: Unclone message at secondary destination lookup	2017-10-08 21:13:23 -07:00
msg.h	tipc: introduce replicast as transport option for multicast	2017-01-20 12:10:17 -05:00
name_distr.c	tipc: allocate user memory with GFP_KERNEL flag	2017-01-16 13:31:53 -05:00
name_distr.h	tipc: reduce code dependency between binding table and node layer	2015-11-20 14:06:10 -05:00
name_table.c	tipc: adjust the policy of holding subscription kref	2017-03-28 18:03:33 -07:00
name_table.h	tipc: add functionality to lookup multicast destination nodes	2017-01-20 12:10:16 -05:00
net.c	netlink: pass extended ACK struct where available	2017-04-13 13:58:22 -04:00
net.h	tipc: add peer removal functionality	2016-08-18 23:36:07 -07:00
netlink.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netlink.h	tipc: make cluster size threshold for monitoring configurable	2016-07-26 14:26:42 -07:00
netlink_compat.c	net: tipc: constify genl_ops	2017-08-23 22:31:38 -07:00
node.c	tipc: fix a memory leak in tipc_nl_node_get_link()	2018-01-31 14:03:46 +01:00
node.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
server.c	tipc: fix memory leak in tipc_accept_from_sock()	2017-12-17 15:07:56 +01:00
server.h	tipc: fix a race condition leading to subscriber refcnt bug	2016-04-14 16:46:46 -04:00
socket.c	tipc: fix hanging poll() for stream sockets	2018-01-02 20:31:11 +01:00
socket.h	tipc: redesign connection-level flow control	2016-05-03 15:51:16 -04:00
subscr.c	tipc: fix a race condition of releasing subscriber object	2017-08-22 14:25:02 -07:00
subscr.h	tipc: adjust the policy of holding subscription kref	2017-03-28 18:03:33 -07:00
sysctl.c	tipc: add name distributor resiliency queue	2014-09-01 17:51:48 -07:00
udp_media.c	tipc: call tipc_rcv() only if bearer is up in tipc_udp_recv()	2017-12-17 15:07:57 +01:00
udp_media.h	tipc: add UDP remoteip dump to netlink API	2016-08-26 21:38:41 -07:00