lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 125/310] rds; Reset rs->rs_bound_addr in rds_add_bound() failure path
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sowmini Varadhan <sowmini.varadhan@oracle.com>


    [ Upstream commit 7ae0c649c47f1c5d2db8cee6dd75855970af1669 ]

    If the rds_sock is not added to the bind_hash_table, we must
    reset rs_bound_addr so that rds_remove_bound will not trip on
    this rds_sock.

    rds_add_bound() does a rds_sock_put() in this failure path, so
    failing to reset rs_bound_addr will result in a socket refcount
    bug, and will trigger a WARN_ON with the stack shown below when
    the application subsequently tries to close the PF_RDS socket.

    WARNING: CPU: 20 PID: 19499 at net/rds/af_rds.c:496 \
    rds_sock_destruct+0x15/0x30 [rds]
    :
    __sk_destruct+0x21/0x190
    rds_remove_bound.part.13+0xb6/0x140 [rds]
    rds_release+0x71/0x120 [rds]
    sock_release+0x1a/0x70
    sock_close+0xe/0x20
    __fput+0xd5/0x210
    task_work_run+0x82/0xa0
    do_exit+0x2ce/0xb30
    ? syscall_trace_enter+0x1cc/0x2b0
    do_group_exit+0x39/0xa0
    SyS_exit_group+0x10/0x10
    do_syscall_64+0x61/0x1a0

    Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
    Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/rds/bind.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/net/rds/bind.c
    +++ b/net/rds/bind.c
    @@ -114,6 +114,7 @@ static int rds_add_bound(struct rds_sock
    rs, &addr, (int)ntohs(*port));
    break;
    } else {
    + rs->rs_bound_addr = 0;
    rds_sock_put(rs);
    ret = -ENOMEM;
    break;

    \
     
     \ /
      Last update: 2018-04-11 21:52    [W:3.464 / U:0.856 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site