From: Sasha Levin Date: Mon, 10 Feb 2020 03:11:56 +0000 (-0500) Subject: fixes for 4.14 X-Git-Tag: v4.19.103~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5f918e7d0d01fb9e869843f302bf8813d3d545ab;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/rxrpc-fix-service-call-disconnection.patch b/queue-4.14/rxrpc-fix-service-call-disconnection.patch new file mode 100644 index 00000000000..336dee1c794 --- /dev/null +++ b/queue-4.14/rxrpc-fix-service-call-disconnection.patch @@ -0,0 +1,63 @@ +From 7e8c29dd5bd21483d5faef28cec331b708f351ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2020 13:55:01 +0000 +Subject: rxrpc: Fix service call disconnection + +From: David Howells + +[ Upstream commit b39a934ec72fa2b5a74123891f25273a38378b90 ] + +The recent patch that substituted a flag on an rxrpc_call for the +connection pointer being NULL as an indication that a call was disconnected +puts the set_bit in the wrong place for service calls. This is only a +problem if a call is implicitly terminated by a new call coming in on the +same connection channel instead of a terminating ACK packet. + +In such a case, rxrpc_input_implicit_end_call() calls +__rxrpc_disconnect_call(), which is now (incorrectly) setting the +disconnection bit, meaning that when rxrpc_release_call() is later called, +it doesn't call rxrpc_disconnect_call() and so the call isn't removed from +the peer's error distribution list and the list gets corrupted. + +KASAN finds the issue as an access after release on a call, but the +position at which it occurs is confusing as it appears to be related to a +different call (the call site is where the latter call is being removed +from the error distribution list and either the next or pprev pointer +points to a previously released call). + +Fix this by moving the setting of the flag from __rxrpc_disconnect_call() +to rxrpc_disconnect_call() in the same place that the connection pointer +was being cleared. + +Fixes: 5273a191dca6 ("rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect") +Signed-off-by: David Howells +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/conn_object.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c +index 13b29e491de91..af02328205979 100644 +--- a/net/rxrpc/conn_object.c ++++ b/net/rxrpc/conn_object.c +@@ -163,8 +163,6 @@ void __rxrpc_disconnect_call(struct rxrpc_connection *conn, + + _enter("%d,%x", conn->debug_id, call->cid); + +- set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); +- + if (rcu_access_pointer(chan->call) == call) { + /* Save the result of the call so that we can repeat it if necessary + * through the channel, whilst disposing of the actual call record. +@@ -209,6 +207,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call) + __rxrpc_disconnect_call(conn, call); + spin_unlock(&conn->channel_lock); + ++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); + conn->idle_timestamp = jiffies; + } + +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 2b24820e4de..e2ea4938be4 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -137,3 +137,4 @@ kvm-s390-do-not-clobber-registers-during-guest-reset.patch cifs-fail-i-o-on-soft-mounts-if-sessionsetup-errors-out.patch clocksource-prevent-double-add_timer_on-for-watchdog_timer.patch perf-core-fix-mlock-accounting-in-perf_mmap.patch +rxrpc-fix-service-call-disconnection.patch