1. 04 Mar, 2018 4 commits
  2. 02 Mar, 2018 4 commits
    • Ka-Cheong Poon's avatar
      rds: Incorrect reference counting in TCP socket creation · 84eef2b2
      Ka-Cheong Poon authored
      Commit 0933a578 ("rds: tcp: use sock_create_lite() to create the
      accept socket") has a reference counting issue in TCP socket creation
      when accepting a new connection.  The code uses sock_create_lite() to
      create a kernel socket.  But it does not do __module_get() on the
      socket owner.  When the connection is shutdown and sock_release() is
      called to free the socket, the owner's reference count is decremented
      and becomes incorrect.  Note that this bug only shows up when the socket
      owner is configured as a kernel module.
      
      v2: Update comments
      
      Fixes: 0933a578 ("rds: tcp: use sock_create_lite() to create the accept socket")
      Signed-off-by: default avatarKa-Cheong Poon <ka-cheong.poon@oracle.com>
      Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
      Acked-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      84eef2b2
    • Edward Cree's avatar
      net: ethtool: don't ignore return from driver get_fecparam method · a6d50512
      Edward Cree authored
      If ethtool_ops->get_fecparam returns an error, pass that error on to the
       user, rather than ignoring it.
      
      Fixes: 1a5f3da2 ("net: ethtool: add support for forward error correction modes")
      Signed-off-by: default avatarEdward Cree <ecree@solarflare.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a6d50512
    • Stephen Suryaputra's avatar
      vrf: check forwarding on the original netdevice when generating ICMP dest unreachable · e2c0dc1f
      Stephen Suryaputra authored
      When ip_error() is called the device is the l3mdev master instead of the
      original device. So the forwarding check should be on the original one.
      
      Changes from v2:
      - Handle the original device disappearing (per David Ahern)
      - Minimize the change in code order
      
      Changes from v1:
      - Only need to reset the device on which __in_dev_get_rcu() is done (per
        David Ahern).
      Signed-off-by: default avatarStephen Suryaputra <ssuryaextr@gmail.com>
      Acked-by: default avatarDavid Ahern <dsahern@gmail.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      e2c0dc1f
    • Mike Manning's avatar
      net: allow interface to be set into VRF if VLAN interface in same VRF · 50d629e7
      Mike Manning authored
      Setting an interface into a VRF fails with 'RTNETLINK answers: File
      exists' if one of its VLAN interfaces is already in the same VRF.
      As the VRF is an upper device of the VLAN interface, it is also showing
      up as an upper device of the interface itself. The solution is to
      restrict this check to devices other than master. As only one master
      device can be linked to a device, the check in this case is that the
      upper device (VRF) being linked to is not the same as the master device
      instead of it not being any one of the upper devices.
      
      The following example shows an interface ens12 (with a VLAN interface
      ens12.10) being set into VRF green, which behaves as expected:
      
        # ip link add link ens12 ens12.10 type vlan id 10
        # ip link set dev ens12 master vrfgreen
        # ip link show dev ens12
          3: ens12: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel
             master vrfgreen state UP mode DEFAULT group default qlen 1000
             link/ether 52:54:00:4c:a0:45 brd ff:ff:ff:ff:ff:ff
      
      But if the VLAN interface has previously been set into the same VRF,
      then setting the interface into the VRF fails:
      
        # ip link set dev ens12 nomaster
        # ip link set dev ens12.10 master vrfgreen
        # ip link show dev ens12.10
          39: ens12.10@ens12: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
          qdisc noqueue master vrfgreen state UP mode DEFAULT group default
          qlen 1000 link/ether 52:54:00:4c:a0:45 brd ff:ff:ff:ff:ff:ff
        # ip link set dev ens12 master vrfgreen
          RTNETLINK answers: File exists
      
      The workaround is to move the VLAN interface back into the default VRF
      beforehand, but it has to be shut first so as to avoid the risk of
      traffic leaking from the VRF. This fix avoids needing this workaround.
      Signed-off-by: default avatarMike Manning <mmanning@att.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      50d629e7
  3. 01 Mar, 2018 1 commit
  4. 28 Feb, 2018 9 commits
  5. 27 Feb, 2018 12 commits
  6. 26 Feb, 2018 9 commits
    • Thomas Winter's avatar
      ip_tunnel: Do not use mark in skb by default · 4e994776
      Thomas Winter authored
      This reverts commit 5c38bd1b.
      
      skb->mark contains the mark the encapsulated traffic which
      can result in incorrect routing decisions being made such
      as routing loops if the route chosen is via tunnel itself.
      The correct method should be to use tunnel->fwmark.
      Signed-off-by: default avatarThomas Winter <thomas.winter@alliedtelesis.co.nz>
      Cc: "David S. Miller" <davem@davemloft.net>
      Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
      Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4e994776
    • Ido Schimmel's avatar
      bridge: Fix VLAN reference count problem · 0e5a82ef
      Ido Schimmel authored
      When a VLAN is added on a port, a reference is taken on the
      corresponding master VLAN entry. If it does not already exist, then it
      is created and a reference taken.
      
      However, in the second case a reference is not really taken when
      CONFIG_REFCOUNT_FULL is enabled as refcount_inc() is replaced by
      refcount_inc_not_zero().
      
      Fix this by using refcount_set() on a newly created master VLAN entry.
      
      Fixes: 25127759 ("net, bridge: convert net_bridge_vlan.refcnt from atomic_t to refcount_t")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Acked-by: default avatarNikolay Aleksandrov <nikolay@cumulusnetworks.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      0e5a82ef
    • Ramon Fried's avatar
      qrtr: add MODULE_ALIAS macro to smd · c77f5fbb
      Ramon Fried authored
      Added MODULE_ALIAS("rpmsg:IPCRTR") to ensure qrtr-smd and qrtr will load
      when IPCRTR channel is detected.
      Signed-off-by: default avatarRamon Fried <rfried@codeaurora.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      c77f5fbb
    • James Chapman's avatar
      l2tp: fix tunnel lookup use-after-free race · 28f5bfb8
      James Chapman authored
      l2tp_tunnel_get walks the tunnel list to find a matching tunnel
      instance and if a match is found, its refcount is increased before
      returning the tunnel pointer. But when tunnel objects are destroyed,
      they are on the tunnel list after their refcount hits zero. Fix this
      by moving the code that removes the tunnel from the tunnel list from
      the tunnel socket destructor into in the l2tp_tunnel_delete path,
      before the tunnel refcount is decremented.
      
      refcount_t: increment on 0; use-after-free.
      WARNING: CPU: 3 PID: 13507 at lib/refcount.c:153 refcount_inc+0x47/0x50
      Modules linked in:
      CPU: 3 PID: 13507 Comm: syzbot_6e6a5ec8 Not tainted 4.16.0-rc2+ #36
      Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      RIP: 0010:refcount_inc+0x47/0x50
      RSP: 0018:ffff8800136ffb20 EFLAGS: 00010286
      RAX: dffffc0000000008 RBX: ffff880017068e68 RCX: ffffffff814d3333
      RDX: 0000000000000000 RSI: ffff88001a59f6d8 RDI: ffff88001a59f6d8
      RBP: ffff8800136ffb28 R08: 0000000000000000 R09: 0000000000000000
      R10: ffff8800136ffab0 R11: 0000000000000000 R12: ffff880017068e50
      R13: 0000000000000000 R14: ffff8800174da800 R15: 0000000000000004
      FS:  00007f403ab1e700(0000) GS:ffff88001a580000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000205fafd2 CR3: 0000000016770000 CR4: 00000000000006e0
      Call Trace:
       l2tp_tunnel_get+0x2dd/0x4e0
       pppol2tp_connect+0x428/0x13c0
       ? pppol2tp_session_create+0x170/0x170
       ? __might_fault+0x115/0x1d0
       ? lock_downgrade+0x860/0x860
       ? __might_fault+0xe5/0x1d0
       ? security_socket_connect+0x8e/0xc0
       SYSC_connect+0x1b6/0x310
       ? SYSC_bind+0x280/0x280
       ? __do_page_fault+0x5d1/0xca0
       ? up_read+0x1f/0x40
       ? __do_page_fault+0x3c8/0xca0
       SyS_connect+0x29/0x30
       ? SyS_accept+0x40/0x40
       do_syscall_64+0x1e0/0x730
       ? trace_hardirqs_off_thunk+0x1a/0x1c
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x7f403a42f259
      RSP: 002b:00007f403ab1dee8 EFLAGS: 00000296 ORIG_RAX: 000000000000002a
      RAX: ffffffffffffffda RBX: 00000000205fafe4 RCX: 00007f403a42f259
      RDX: 000000000000002e RSI: 00000000205fafd2 RDI: 0000000000000004
      RBP: 00007f403ab1df20 R08: 00007f403ab1e700 R09: 0000000000000000
      R10: 00007f403ab1e700 R11: 0000000000000296 R12: 0000000000000000
      R13: 00007ffc81906cbf R14: 0000000000000000 R15: 00007f403ab2b040
      Code: 3b ff 5b 5d c3 e8 ca 5f 3b ff 80 3d 49 8e 66 04 00 75 ea e8 bc 5f 3b ff 48 c7 c7 60 69 64 85 c6 05 34 8e 66 04 01 e8 59 49 15 ff <0f> 0b eb ce 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 49
      
      Fixes: f8ccac0e ("l2tp: put tunnel socket release on a workqueue")
      Reported-and-tested-by: syzbot+19c09769f14b48810113@syzkaller.appspotmail.com
      Reported-and-tested-by: syzbot+347bd5acde002e353a36@syzkaller.appspotmail.com
      Reported-and-tested-by: syzbot+6e6a5ec8de31a94cd015@syzkaller.appspotmail.com
      Reported-and-tested-by: syzbot+9df43faf09bd400f2993@syzkaller.appspotmail.com
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      28f5bfb8
    • James Chapman's avatar
      l2tp: fix race in pppol2tp_release with session object destroy · d02ba2a6
      James Chapman authored
      pppol2tp_release uses call_rcu to put the final ref on its socket. But
      the session object doesn't hold a ref on the session socket so may be
      freed while the pppol2tp_put_sk RCU callback is scheduled. Fix this by
      having the session hold a ref on its socket until the session is
      destroyed. It is this ref that is dropped via call_rcu.
      
      Sessions are also deleted via l2tp_tunnel_closeall. This must now also put
      the final ref via call_rcu. So move the call_rcu call site into
      pppol2tp_session_close so that this happens in both destroy paths. A
      common destroy path should really be implemented, perhaps with
      l2tp_tunnel_closeall calling l2tp_session_delete like pppol2tp_release
      does, but this will be looked at later.
      
      ODEBUG: activate active (active state 1) object type: rcu_head hint:           (null)
      WARNING: CPU: 3 PID: 13407 at lib/debugobjects.c:291 debug_print_object+0x166/0x220
      Modules linked in:
      CPU: 3 PID: 13407 Comm: syzbot_19c09769 Not tainted 4.16.0-rc2+ #38
      Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      RIP: 0010:debug_print_object+0x166/0x220
      RSP: 0018:ffff880013647a00 EFLAGS: 00010082
      RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff814d3333
      RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88001a59f6d0
      RBP: ffff880013647a40 R08: 0000000000000000 R09: 0000000000000001
      R10: ffff8800136479a8 R11: 0000000000000000 R12: 0000000000000001
      R13: ffffffff86161420 R14: ffffffff85648b60 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88001a580000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020e77000 CR3: 0000000006022000 CR4: 00000000000006e0
      Call Trace:
       debug_object_activate+0x38b/0x530
       ? debug_object_assert_init+0x3b0/0x3b0
       ? __mutex_unlock_slowpath+0x85/0x8b0
       ? pppol2tp_session_destruct+0x110/0x110
       __call_rcu.constprop.66+0x39/0x890
       ? __call_rcu.constprop.66+0x39/0x890
       call_rcu_sched+0x17/0x20
       pppol2tp_release+0x2c7/0x440
       ? fcntl_setlk+0xca0/0xca0
       ? sock_alloc_file+0x340/0x340
       sock_release+0x92/0x1e0
       sock_close+0x1b/0x20
       __fput+0x296/0x6e0
       ____fput+0x1a/0x20
       task_work_run+0x127/0x1a0
       do_exit+0x7f9/0x2ce0
       ? SYSC_connect+0x212/0x310
       ? mm_update_next_owner+0x690/0x690
       ? up_read+0x1f/0x40
       ? __do_page_fault+0x3c8/0xca0
       do_group_exit+0x10d/0x330
       ? do_group_exit+0x330/0x330
       SyS_exit_group+0x22/0x30
       do_syscall_64+0x1e0/0x730
       ? trace_hardirqs_off_thunk+0x1a/0x1c
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x7f362e471259
      RSP: 002b:00007ffe389abe08 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
      RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f362e471259
      RDX: 00007f362e471259 RSI: 000000000000002e RDI: 0000000000000000
      RBP: 00007ffe389abe30 R08: 0000000000000000 R09: 00007f362e944270
      R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400b60
      R13: 00007ffe389abf50 R14: 0000000000000000 R15: 0000000000000000
      Code: 8d 3c dd a0 8f 64 85 48 89 fa 48 c1 ea 03 80 3c 02 00 75 7b 48 8b 14 dd a0 8f 64 85 4c 89 f6 48 c7 c7 20 85 64 85 e
      8 2a 55 14 ff <0f> 0b 83 05 ad 2a 68 04 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41
      
      Fixes: ee40fb2e ("l2tp: protect sock pointer of struct pppol2tp_session with RCU")
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d02ba2a6
    • James Chapman's avatar
      l2tp: fix races with tunnel socket close · d00fa9ad
      James Chapman authored
      The tunnel socket tunnel->sock (struct sock) is accessed when
      preparing a new ppp session on a tunnel at pppol2tp_session_init. If
      the socket is closed by a thread while another is creating a new
      session, the threads race. In pppol2tp_connect, the tunnel object may
      be created if the pppol2tp socket is associated with the special
      session_id 0 and the tunnel socket is looked up using the provided
      fd. When handling this, pppol2tp_connect cannot sock_hold the tunnel
      socket to prevent it being destroyed during pppol2tp_connect since
      this may itself may race with the socket being destroyed. Doing
      sockfd_lookup in pppol2tp_connect isn't sufficient to prevent
      tunnel->sock going away either because a given tunnel socket fd may be
      reused between calls to pppol2tp_connect. Instead, have
      l2tp_tunnel_create sock_hold the tunnel socket before it does
      sockfd_put. This ensures that the tunnel's socket is always extant
      while the tunnel object exists. Hold a ref on the socket until the
      tunnel is destroyed and ensure that all tunnel destroy paths go
      through a common function (l2tp_tunnel_delete) since this will do the
      final sock_put to release the tunnel socket.
      
      Since the tunnel's socket is now guaranteed to exist if the tunnel
      exists, we no longer need to use sockfd_lookup via l2tp_sock_to_tunnel
      to derive the tunnel from the socket since this is always
      sk_user_data.
      
      Also, sessions no longer sock_hold the tunnel socket since sessions
      already hold a tunnel ref and the tunnel sock will not be freed until
      the tunnel is freed. Removing these sock_holds in
      l2tp_session_register avoids a possible sock leak in the
      pppol2tp_connect error path if l2tp_session_register succeeds but
      attaching a ppp channel fails. The pppol2tp_connect error path could
      have been fixed instead and have the sock ref dropped when the session
      is freed, but doing a sock_put of the tunnel socket when the session
      is freed would require a new session_free callback. It is simpler to
      just remove the sock_hold of the tunnel socket in
      l2tp_session_register, now that the tunnel socket lifetime is
      guaranteed.
      
      Finally, some init code in l2tp_tunnel_create is reordered to ensure
      that the new tunnel object's refcount is set and the tunnel socket ref
      is taken before the tunnel socket destructor callbacks are set.
      
      kasan: CONFIG_KASAN_INLINE enabled
      kasan: GPF could be caused by NULL-ptr deref or user memory access
      general protection fault: 0000 [#1] SMP KASAN
      Modules linked in:
      CPU: 0 PID: 4360 Comm: syzbot_19c09769 Not tainted 4.16.0-rc2+ #34
      Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      RIP: 0010:pppol2tp_session_init+0x1d6/0x500
      RSP: 0018:ffff88001377fb40 EFLAGS: 00010212
      RAX: dffffc0000000000 RBX: ffff88001636a940 RCX: ffffffff84836c1d
      RDX: 0000000000000045 RSI: 0000000055976744 RDI: 0000000000000228
      RBP: ffff88001377fb60 R08: ffffffff84836bc8 R09: 0000000000000002
      R10: ffff88001377fab8 R11: 0000000000000001 R12: 0000000000000000
      R13: ffff88001636aac8 R14: ffff8800160f81c0 R15: 1ffff100026eff76
      FS:  00007ffb3ea66700(0000) GS:ffff88001a400000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000020e77000 CR3: 0000000016261000 CR4: 00000000000006f0
      Call Trace:
       pppol2tp_connect+0xd18/0x13c0
       ? pppol2tp_session_create+0x170/0x170
       ? __might_fault+0x115/0x1d0
       ? lock_downgrade+0x860/0x860
       ? __might_fault+0xe5/0x1d0
       ? security_socket_connect+0x8e/0xc0
       SYSC_connect+0x1b6/0x310
       ? SYSC_bind+0x280/0x280
       ? __do_page_fault+0x5d1/0xca0
       ? up_read+0x1f/0x40
       ? __do_page_fault+0x3c8/0xca0
       SyS_connect+0x29/0x30
       ? SyS_accept+0x40/0x40
       do_syscall_64+0x1e0/0x730
       ? trace_hardirqs_off_thunk+0x1a/0x1c
       entry_SYSCALL_64_after_hwframe+0x42/0xb7
      RIP: 0033:0x7ffb3e376259
      RSP: 002b:00007ffeda4f6508 EFLAGS: 00000202 ORIG_RAX: 000000000000002a
      RAX: ffffffffffffffda RBX: 0000000020e77012 RCX: 00007ffb3e376259
      RDX: 000000000000002e RSI: 0000000020e77000 RDI: 0000000000000004
      RBP: 00007ffeda4f6540 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000400b60
      R13: 00007ffeda4f6660 R14: 0000000000000000 R15: 0000000000000000
      Code: 80 3d b0 ff 06 02 00 0f 84 07 02 00 00 e8 13 d6 db fc 49 8d bc 24 28 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 f
      a 48 c1 ea 03 <80> 3c 02 00 0f 85 ed 02 00 00 4d 8b a4 24 28 02 00 00 e8 13 16
      
      Fixes: 80d84ef3 ("l2tp: prevent l2tp_tunnel_delete racing with userspace close")
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      d00fa9ad
    • James Chapman's avatar
      l2tp: don't use inet_shutdown on ppp session destroy · 225eb264
      James Chapman authored
      Previously, if a ppp session was closed, we called inet_shutdown to mark
      the socket as unconnected such that userspace would get errors and
      then close the socket. This could race with userspace closing the
      socket. Instead, leave userspace to close the socket in its own time
      (our session will be detached anyway).
      
      BUG: KASAN: use-after-free in inet_shutdown+0x5d/0x1c0
      Read of size 4 at addr ffff880010ea3ac0 by task syzbot_347bd5ac/8296
      
      CPU: 3 PID: 8296 Comm: syzbot_347bd5ac Not tainted 4.16.0-rc1+ #91
      Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
      Call Trace:
       dump_stack+0x101/0x157
       ? inet_shutdown+0x5d/0x1c0
       print_address_description+0x78/0x260
       ? inet_shutdown+0x5d/0x1c0
       kasan_report+0x240/0x360
       __asan_load4+0x78/0x80
       inet_shutdown+0x5d/0x1c0
       ? pppol2tp_show+0x80/0x80
       pppol2tp_session_close+0x68/0xb0
       l2tp_tunnel_closeall+0x199/0x210
       ? udp_v6_flush_pending_frames+0x90/0x90
       l2tp_udp_encap_destroy+0x6b/0xc0
       ? l2tp_tunnel_del_work+0x2e0/0x2e0
       udpv6_destroy_sock+0x8c/0x90
       sk_common_release+0x47/0x190
       udp_lib_close+0x15/0x20
       inet_release+0x85/0xd0
       inet6_release+0x43/0x60
       sock_release+0x53/0x100
       ? sock_alloc_file+0x260/0x260
       sock_close+0x1b/0x20
       __fput+0x19f/0x380
       ____fput+0x1a/0x20
       task_work_run+0xd2/0x110
       exit_to_usermode_loop+0x18d/0x190
       do_syscall_64+0x389/0x3b0
       entry_SYSCALL_64_after_hwframe+0x26/0x9b
      RIP: 0033:0x7fe240a45259
      RSP: 002b:00007fe241132df8 EFLAGS: 00000297 ORIG_RAX: 0000000000000003
      RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fe240a45259
      RDX: 00007fe240a45259 RSI: 0000000000000000 RDI: 00000000000000a5
      RBP: 00007fe241132e20 R08: 00007fe241133700 R09: 0000000000000000
      R10: 00007fe241133700 R11: 0000000000000297 R12: 0000000000000000
      R13: 00007ffc49aff84f R14: 0000000000000000 R15: 00007fe241141040
      
      Allocated by task 8331:
       save_stack+0x43/0xd0
       kasan_kmalloc+0xad/0xe0
       kasan_slab_alloc+0x12/0x20
       kmem_cache_alloc+0x144/0x3e0
       sock_alloc_inode+0x22/0x130
       alloc_inode+0x3d/0xf0
       new_inode_pseudo+0x1c/0x90
       sock_alloc+0x30/0x110
       __sock_create+0xaa/0x4c0
       SyS_socket+0xbe/0x130
       do_syscall_64+0x128/0x3b0
       entry_SYSCALL_64_after_hwframe+0x26/0x9b
      
      Freed by task 8314:
       save_stack+0x43/0xd0
       __kasan_slab_free+0x11a/0x170
       kasan_slab_free+0xe/0x10
       kmem_cache_free+0x88/0x2b0
       sock_destroy_inode+0x49/0x50
       destroy_inode+0x77/0xb0
       evict+0x285/0x340
       iput+0x429/0x530
       dentry_unlink_inode+0x28c/0x2c0
       __dentry_kill+0x1e3/0x2f0
       dput.part.21+0x500/0x560
       dput+0x24/0x30
       __fput+0x2aa/0x380
       ____fput+0x1a/0x20
       task_work_run+0xd2/0x110
       exit_to_usermode_loop+0x18d/0x190
       do_syscall_64+0x389/0x3b0
       entry_SYSCALL_64_after_hwframe+0x26/0x9b
      
      Fixes: fd558d18 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts")
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      225eb264
    • James Chapman's avatar
      l2tp: don't use inet_shutdown on tunnel destroy · 76a6abdb
      James Chapman authored
      Previously, if a tunnel was closed, we called inet_shutdown to mark
      the socket as unconnected such that userspace would get errors and
      then close the socket. This could race with userspace closing the
      socket. Instead, leave userspace to close the socket in its own time
      (our tunnel will be detached anyway).
      
      BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0
      IP: __lock_acquire+0x263/0x1630
      PGD 0 P4D 0
      Oops: 0000 [#1] SMP KASAN
      Modules linked in:
      CPU: 2 PID: 42 Comm: kworker/u8:2 Not tainted 4.15.0-rc7+ #129
      Workqueue: l2tp l2tp_tunnel_del_work
      RIP: 0010:__lock_acquire+0x263/0x1630
      RSP: 0018:ffff88001a37fc70 EFLAGS: 00010002
      RAX: 0000000000000001 RBX: 0000000000000088 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
      RBP: ffff88001a37fd18 R08: 0000000000000001 R09: 0000000000000000
      R10: 0000000000000000 R11: 00000000000076fd R12: 00000000000000a0
      R13: ffff88001a3722c0 R14: 0000000000000001 R15: 0000000000000000
      FS:  0000000000000000(0000) GS:ffff88001ad00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00000000000000a0 CR3: 000000001730b000 CR4: 00000000000006e0
      Call Trace:
       ? __lock_acquire+0xc77/0x1630
       ? console_trylock+0x11/0xa0
       lock_acquire+0x117/0x230
       ? lock_sock_nested+0x3a/0xa0
       _raw_spin_lock_bh+0x3a/0x50
       ? lock_sock_nested+0x3a/0xa0
       lock_sock_nested+0x3a/0xa0
       inet_shutdown+0x33/0xf0
       l2tp_tunnel_del_work+0x60/0xef
       process_one_work+0x1ea/0x5f0
       ? process_one_work+0x162/0x5f0
       worker_thread+0x48/0x3e0
       ? trace_hardirqs_on+0xd/0x10
       kthread+0x108/0x140
       ? process_one_work+0x5f0/0x5f0
       ? kthread_stop+0x2a0/0x2a0
       ret_from_fork+0x24/0x30
      Code: 00 41 81 ff ff 1f 00 00 0f 87 7a 13 00 00 45 85 f6 49 8b 85
      68 08 00 00 0f 84 ae 03 00 00 c7 44 24 18 00 00 00 00 e9 f0 00 00 00 <49> 81 3c
      24 80 93 3f 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f
      RIP: __lock_acquire+0x263/0x1630 RSP: ffff88001a37fc70
      CR2: 00000000000000a0
      
      Fixes: 309795f4 ("l2tp: Add netlink control API for L2TP")
      Signed-off-by: default avatarJames Chapman <jchapman@katalix.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      76a6abdb
    • Chengguang Xu's avatar
      libceph, ceph: avoid memory leak when specifying same option several times · 937441f3
      Chengguang Xu authored
      When parsing string option, in order to avoid memory leak we need to
      carefully free it first in case of specifying same option several times.
      Signed-off-by: default avatarChengguang Xu <cgxu519@icloud.com>
      Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
      Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
      937441f3
  7. 25 Feb, 2018 1 commit