Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-16 09:56:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
linux/net/rds
History
Tetsuo Handa 3a58f13a88 net: rds: acquire refcount on TCP sockets 
syzbot is reporting use-after-free read in tcp_retransmit_timer() [1],
for TCP socket used by RDS is accessing sock_net() without acquiring a
refcount on net namespace. Since TCP's retransmission can happen after
a process which created net namespace terminated, we need to explicitly
acquire a refcount.

Link: https://syzkaller.appspot.com/bug?extid=694120e1002c117747ed [1]
Reported-by: syzbot <syzbot+694120e1002c117747ed@syzkaller.appspotmail.com>
Fixes: 26abe14379f8e2fa ("net: Modify sk_alloc to not reference count the netns of kernel sockets.")
Fixes: 8a68173691f03661 ("net: sk_clone_lock() should only do get_net() if the parent is not a kernel socket")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: syzbot <syzbot+694120e1002c117747ed@syzkaller.appspotmail.com>
Link: https://lore.kernel.org/r/a5fb1fc4-2284-3359-f6a0-e4e390239d7b@I-love.SAKURA.ne.jp
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2022-05-03 13:22:50 +02:00
..
af_rds.c
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
bind.c
net/rds: Check laddr_check before calling it
2019-09-27 12:10:55 +02:00
cong.c
net: rds: delete duplicated words
2020-09-18 14:12:43 -07:00
connection.c
rds: memory leak in __rds_conn_create()
2021-12-14 12:51:52 +00:00
ib_cm.c
rds: ib: Remove two ib_modify_qp() calls
2021-04-12 19:51:48 -03:00
ib_frmr.c
net/rds: dma_map_sg is entitled to merge entries
2021-08-18 15:35:50 -07:00
ib_mr.h
RDMA/rds: Remove FMR support for memory registration
2020-06-02 20:32:53 -03:00
ib_rdma.c
RDMA/rds: Remove FMR support for memory registration
2020-06-02 20:32:53 -03:00
ib_recv.c
rds: stop using dmapool
2020-11-17 15:22:06 -04:00
ib_ring.c
rds: Fix spelling mistakes
2021-05-31 22:45:05 -07:00
ib_send.c
rds: Remove redundant assignment to nr_sig
2021-04-27 14:14:33 -07:00
ib_stats.c
net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
2019-09-15 20:56:19 +02:00
ib_sysctl.c
net: Convert uses of typedef ctl_table to struct ctl_table
2013-06-13 02:36:09 -07:00
ib.c
rds: stop using dmapool
2020-11-17 15:22:06 -04:00
ib.h
rds: stop using dmapool
2020-11-17 15:22:06 -04:00
info.c
rds: fix crash in rds_info_getsockopt()
2020-05-20 14:08:06 -07:00
info.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
Kconfig
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
loop.c
rds: Changing IP address internal representation to struct in6_addr
2018-07-23 21:17:44 -07:00
loop.h
rds: clean up loopback rds_connections on netns deletion
2018-06-27 10:11:03 +09:00
Makefile
RDMA/rds: Remove FMR support for memory registration
2020-06-02 20:32:53 -03:00
message.c
Revert "net/rds: Avoid potential use after free in rds_send_remove_from_sock"
2021-04-24 09:32:35 -07:00
page.c
rds: remove dead code
2016-12-26 21:35:39 -05:00
rdma_transport.c
rds: ib: Remove two ib_modify_qp() calls
2021-04-12 19:51:48 -03:00
rdma_transport.h
net: rds: rdma_transport.h: delete duplicated word
2020-07-19 18:14:51 -07:00
rdma.c
net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS
2021-02-02 08:44:08 -08:00
rds_single_path.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
rds.h
net: pass a sockptr_t into ->setsockopt
2020-07-24 15:41:54 -07:00
recv.c
net: rds: fix memory leak in rds_recvmsg
2021-06-08 16:32:17 -07:00
send.c
rds: Fix a typo in a comment
2021-11-22 14:28:37 +00:00
stats.c
rds: check for excessive looping in rds_send_xmit
2019-08-15 12:04:24 -07:00
sysctl.c
net: rds: fix coding style issues
2016-06-18 21:34:09 -07:00
tcp_connect.c
rds: Fix fall-through warnings for Clang
2021-05-17 20:00:27 -05:00
tcp_listen.c
RDS tcp loopback connection can hang
2021-05-21 14:46:59 -07:00
tcp_recv.c
rds: Fix spelling mistakes
2021-05-31 22:45:05 -07:00
tcp_send.c
tcp: add tcp_sock_set_cork
2020-05-28 11:11:45 -07:00
tcp_stats.c
net: rds: fix const array syntax
2011-07-01 16:16:19 -07:00
tcp.c
net: rds: acquire refcount on TCP sockets
2022-05-03 13:22:50 +02:00
tcp.h
RDS tcp loopback connection can hang
2021-05-21 14:46:59 -07:00
threads.c
rds: Fix fall-through warnings for Clang
2021-05-17 20:00:27 -05:00
transport.c
rds: transport module should be auto loaded when transport is set
2020-06-25 16:26:25 -07:00