David Howells 4a7f62f919 rxrpc: Fix call timer start racing with call destruction ... The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the same time a packet comes in addressed to that call. This causes the timer - which was already stopped - to get restarted. Later, the timer dispatch code may then oops if the timer got deallocated first. Fix this by trying to take a ref on the rxrpc_call struct and, if successful, passing that ref along to the timer. If the timer was already running, the ref is discarded. The timer completion routine can then pass the ref along to the call's work item when it queues it. If the timer or work item where already queued/running, the extra ref is discarded. Fixes: a158bdd324 ("rxrpc: Fix call timeouts") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> Tested-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2022-March/005073.html Link: https://lore.kernel.org/r/164865115696.2943015.11097991776647323586.stgit@warthog.procyon.org.uk Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2022-03-31 12:25:25 +02:00
..
6lowpan	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
9p	xen/grant-table: remove readonly parameter from functions	2022-03-15 20:34:40 -05:00
802	net: 802: Use memset_startat() to clear struct fields	2021-11-19 11:23:23 +00:00
8021q	vlan: use correct format characters	2022-03-17 16:34:49 -07:00
appletalk	net: socket: rework compat_ifreq_ioctl()	2021-07-23 14:20:25 +01:00
atm	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
ax25	ax25: Fix UAF bugs in ax25 timers	2022-03-29 10:24:34 +02:00
batman-adv	batman-adv: Use netif_rx().	2022-03-07 11:40:41 +00:00
bluetooth	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed	2022-03-18 17:12:08 +01:00
bpf	bpf, test_run: Fix packet size check for live packet mode	2022-03-11 22:01:26 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	net: bridge: mst: Restrict info size queries to bridge ports	2022-03-23 10:32:44 -07:00
caif	net: caif: Use netif_rx().	2022-03-04 12:02:19 +00:00
can	can: isotp: support MSG_TRUNC flag when reading from socket	2022-03-16 21:41:40 +01:00
ceph	libceph: drop else branches in prepare_read_data{,_cont}	2022-03-01 18:26:36 +01:00
core	net: move net_unlink_todo() out of the header	2022-03-28 14:40:08 -07:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp	dccp: remove max48()	2022-01-27 13:53:27 +00:00
decnet	net: decnet: use time_is_before_jiffies() instead of open coding it	2022-02-28 13:21:32 +00:00
dns_resolver	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ethernet	gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers	2021-11-24 17:21:42 -08:00
ethtool	ethtool: add support to set/get completion queue event size	2022-02-23 20:33:05 -08:00
hsr	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
ieee802154	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
ife	net: remove redundant 'depends on NET'	2021-01-27 17:04:12 -08:00
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ipv6	netfilter: nft_fib: add reduce support	2022-03-20 00:29:47 +01:00
iucv	s390/iucv: sort out physical vs virtual pointers usage	2022-02-22 16:09:13 -08:00
kcm	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-03-10 07:39:47 +01:00
l2tp	l2tp: add netns refcount tracker to l2tp_dfs_seq_data	2021-12-10 06:38:27 -08:00
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
lapb	net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c	2021-06-08 16:31:25 -07:00
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	mac80211: update bssid_indicator in ieee80211_assign_beacon	2022-03-15 11:50:33 +01:00
mac802154	mac802154: use dev_addr_set() - manual	2021-10-20 14:27:40 +01:00
mctp	mctp: Avoid warning if unregister notifies twice	2022-02-25 22:23:23 -08:00
mpls	net: mpls: Fix GCC 12 warning	2022-02-10 15:29:39 +00:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ncsi	all: replace find_next{,_zero}_bit with find_first{,_zero}_bit where appropriate	2022-01-15 08:47:31 -08:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf	2022-03-28 08:57:10 -07:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	af_netlink: Fix shift out of bounds in group mask calculation	2022-03-18 21:47:14 -07:00
netrom	netrom: fix api breakage in nr_setsockopt()	2022-01-07 14:11:05 +00:00
nfc	nfc: llcp: Revert "NFC: Keep socket alive until the DISC PDU is actually sent"	2022-03-03 10:43:37 +00:00
nsh	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
openvswitch	openvswitch: Fixed nd target mask field in the flow dump.	2022-03-29 09:47:41 +02:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-17 13:56:58 -07:00
phonet	phonet: Use netif_rx().	2022-03-07 11:40:41 +00:00
psample	psample: Add additional metadata attributes	2021-03-14 15:00:43 -07:00
qrtr	bus: mhi: core: Add an API for auto queueing buffers for DL channel	2021-12-17 17:17:14 +01:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-12-16 16:13:19 -08:00
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose	net: Don't include filter.h from net/sock.h	2021-12-29 08:48:14 -08:00
rxrpc	rxrpc: Fix call timer start racing with call destruction	2022-03-31 12:25:25 +02:00
sched	net/sched: act_ct: fix ref leak when switching zones	2022-03-26 17:00:51 -07:00
sctp	selinux/stable-5.18 PR 20220321	2022-03-21 20:47:54 -07:00
smc	net/smc: Send out the remaining data in sndbuf before close	2022-03-28 16:06:27 -07:00
strparser	bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding	2021-11-09 01:05:28 +01:00
sunrpc	Networking changes for 5.18.	2022-03-24 13:13:26 -07:00
switchdev	net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device	2022-02-24 21:31:43 -08:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
tls	net/tls: optimize judgement processes in tls_set_device_offload()	2022-03-21 14:58:16 -07:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-03-24 18:36:36 -07:00
wireless	brcmfmac	2022-03-11 13:00:17 -08:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-03-26 11:48:16 -07:00
xdp	xsk: Do not write NULL in SW ring at allocation failure	2022-03-28 19:56:28 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/	2022-03-19 14:49:08 +00:00
compat.c	net: Return the correct errno code	2021-06-03 15:13:56 -07:00
devres.c	net: devres: Correct a grammatical error	2021-06-11 12:55:28 -07:00
Kconfig	page_pool: Add allocation stats	2022-03-03 09:55:28 +00:00
Kconfig.debug	net: add networking namespace refcount tracker	2021-12-10 06:38:26 -08:00
Makefile	mctp: Add MCTP base	2021-07-29 15:06:49 +01:00
socket.c	fs: allocate inode by using alloc_inode_sb()	2022-03-22 15:57:03 -07:00
sysctl_net.c	sections: move and rename core_kernel_data() to is_kernel_core_data()	2021-11-09 10:02:50 -08:00