From 5f918e7d0d01fb9e869843f302bf8813d3d545ab Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 9 Feb 2020 22:11:56 -0500 Subject: [PATCH] fixes for 4.14 Signed-off-by: Sasha Levin --- ...rxrpc-fix-service-call-disconnection.patch | 63 +++++++++++++++++++ queue-4.14/series | 1 + 2 files changed, 64 insertions(+) create mode 100644 queue-4.14/rxrpc-fix-service-call-disconnection.patch diff --git a/queue-4.14/rxrpc-fix-service-call-disconnection.patch b/queue-4.14/rxrpc-fix-service-call-disconnection.patch new file mode 100644 index 00000000000..336dee1c794 --- /dev/null +++ b/queue-4.14/rxrpc-fix-service-call-disconnection.patch @@ -0,0 +1,63 @@ +From 7e8c29dd5bd21483d5faef28cec331b708f351ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Feb 2020 13:55:01 +0000 +Subject: rxrpc: Fix service call disconnection + +From: David Howells + +[ Upstream commit b39a934ec72fa2b5a74123891f25273a38378b90 ] + +The recent patch that substituted a flag on an rxrpc_call for the +connection pointer being NULL as an indication that a call was disconnected +puts the set_bit in the wrong place for service calls. This is only a +problem if a call is implicitly terminated by a new call coming in on the +same connection channel instead of a terminating ACK packet. + +In such a case, rxrpc_input_implicit_end_call() calls +__rxrpc_disconnect_call(), which is now (incorrectly) setting the +disconnection bit, meaning that when rxrpc_release_call() is later called, +it doesn't call rxrpc_disconnect_call() and so the call isn't removed from +the peer's error distribution list and the list gets corrupted. + +KASAN finds the issue as an access after release on a call, but the +position at which it occurs is confusing as it appears to be related to a +different call (the call site is where the latter call is being removed +from the error distribution list and either the next or pprev pointer +points to a previously released call). + +Fix this by moving the setting of the flag from __rxrpc_disconnect_call() +to rxrpc_disconnect_call() in the same place that the connection pointer +was being cleared. + +Fixes: 5273a191dca6 ("rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect") +Signed-off-by: David Howells +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/conn_object.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c +index 13b29e491de91..af02328205979 100644 +--- a/net/rxrpc/conn_object.c ++++ b/net/rxrpc/conn_object.c +@@ -163,8 +163,6 @@ void __rxrpc_disconnect_call(struct rxrpc_connection *conn, + + _enter("%d,%x", conn->debug_id, call->cid); + +- set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); +- + if (rcu_access_pointer(chan->call) == call) { + /* Save the result of the call so that we can repeat it if necessary + * through the channel, whilst disposing of the actual call record. +@@ -209,6 +207,7 @@ void rxrpc_disconnect_call(struct rxrpc_call *call) + __rxrpc_disconnect_call(conn, call); + spin_unlock(&conn->channel_lock); + ++ set_bit(RXRPC_CALL_DISCONNECTED, &call->flags); + conn->idle_timestamp = jiffies; + } + +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 2b24820e4de..e2ea4938be4 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -137,3 +137,4 @@ kvm-s390-do-not-clobber-registers-during-guest-reset.patch cifs-fail-i-o-on-soft-mounts-if-sessionsetup-errors-out.patch clocksource-prevent-double-add_timer_on-for-watchdog_timer.patch perf-core-fix-mlock-accounting-in-perf_mmap.patch +rxrpc-fix-service-call-disconnection.patch -- 2.47.3