From: Sasha Levin Date: Mon, 10 Feb 2020 03:11:56 +0000 (-0500) Subject: fixes for 4.9 X-Git-Tag: v4.19.103~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=65fe118739705e03bbdb0f2675a5db60f384f148;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/rxrpc-fix-service-call-disconnection.patch b/queue-4.9/rxrpc-fix-service-call-disconnection.patch new file mode 100644 index 00000000000..8189feb1c62 --- /dev/null +++ b/queue-4.9/rxrpc-fix-service-call-disconnection.patch @@ -0,0 +1,63 @@ +From 89d815750d288127abb27eedf62fb7606c59cd69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2020 13:55:01 +0000 +Subject: rxrpc: Fix service call disconnection + +From: David Howells + +[ Upstream commit b39a934ec72fa2b5a74123891f25273a38378b90 ] + +The recent patch that substituted a flag on an rxrpc_call for the +connection pointer being NULL as an indication that a call was disconnected +puts the set_bit in the wrong place for service calls. This is only a +problem if a call is implicitly terminated by a new call coming in on the +same connection channel instead of a terminating ACK packet. + +In such a case, rxrpc_input_implicit_end_call() calls +__rxrpc_disconnect_call(), which is now (incorrectly) setting the +disconnection bit, meaning that when rxrpc_release_call() is later called, +it doesn't call rxrpc_disconnect_call() and so the call isn't removed from +the peer's error distribution list and the list gets corrupted. + +KASAN finds the issue as an access after release on a call, but the +position at which it occurs is confusing as it appears to be related to a +different call (the call site is where the latter call is being removed +from the error distribution list and either the next or pprev pointer +points to a previously released call). + +Fix this by moving the setting of the flag from __rxrpc_disconnect_call() +to rxrpc_disconnect_call() in the same place that the connection pointer +was being cleared. + +Fixes: 5273a191dca6 ("rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect") +Signed-off-by: David Howells +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/conn_object.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c +index dcf438f677840..e7c89b978587d 100644 +--- a/net/rxrpc/conn_object.c ++++ b/net/rxrpc/conn_object.c +@@ -169,8 +169,6 @@ void __rxrpc_disconnect_call(struct rxrpc_connection *conn, + + _enter("%d,%x", conn->debug_id, call->cid); + +- set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); +- + if (rcu_access_pointer(chan->call) == call) { + /* Save the result of the call so that we can repeat it if necessary + * through the channel, whilst disposing of the actual call record. +@@ -213,6 +211,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call) + __rxrpc_disconnect_call(conn, call); + spin_unlock(&conn->channel_lock); + ++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); + conn->idle_timestamp = jiffies; + } + +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 1a3ad8f4245..718da544317 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -93,3 +93,4 @@ kvm-nvmx-vmread-should-not-set-rflags-to-specify-suc.patch cifs-fail-i-o-on-soft-mounts-if-sessionsetup-errors-out.patch clocksource-prevent-double-add_timer_on-for-watchdog_timer.patch perf-core-fix-mlock-accounting-in-perf_mmap.patch +rxrpc-fix-service-call-disconnection.patch