Parthasarathy Bhuvaragan d094c4d5f5 tipc: add subscription refcount to avoid invalid delete ... Until now, the subscribers keep track of the subscriptions using reference count at subscriber level. At subscription cancel or subscriber delete, we delete the subscription only if the timer was pending for the subscription. This approach is incorrect as: 1. del_timer() is not SMP safe, if on CPU0 the check for pending timer returns true but CPU1 might schedule the timer callback thereby deleting the subscription. Thus when CPU0 is scheduled, it deletes an invalid subscription. 2. We export tipc_subscrp_report_overlap(), which accesses the subscription pointer multiple times. Meanwhile the subscription timer can expire thereby freeing the subscription and we might continue to access the subscription pointer leading to memory violations. In this commit, we introduce subscription refcount to avoid deleting an invalid subscription. Reported-and-Tested-by: John Thompson <thompa.atl@gmail.com> Acked-by: Ying Xue <ying.xue@windriver.com> Acked-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-01-24 16:14:57 -05:00
..
6lowpan	6lowpan: ndisc: no overreact if no short address is available	2016-09-19 20:19:34 +02:00
9p	IB/core: add support to create a unsafe global rkey to ib_create_pd	2016-09-23 13:47:44 -04:00
802	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
8021q	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
appletalk	appletalk: use IS_ENABLED() instead of checking for built-in or module	2016-09-10 21:19:10 -07:00
atm	net: atm: Fix warnings in net/atm/lec.c when !CONFIG_PROC_FS	2016-12-28 15:11:32 -05:00
ax25	ax25: Fix segfault after sock connection timeout	2017-01-16 14:39:58 -05:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-06 21:33:19 -05:00
bluetooth	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-12-16 10:24:44 -08:00
bridge	bridge: netlink: call br_changelink() during br_dev_newlink()	2017-01-20 15:07:27 -05:00
caif	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-06 21:33:19 -05:00
can	ktime: Cleanup ktime_set() usage	2016-12-25 17:21:22 +01:00
ceph	libceph: remove now unused finish_request() wrapper	2016-12-14 22:39:08 +01:00
core	lwtunnel: fix autoload of lwt modules	2017-01-18 17:07:14 -05:00
dcb	net: dcb: set error code on failures	2016-12-03 23:54:25 -05:00
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-03 12:29:53 -05:00
decnet	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
dns_resolver
dsa	net: dsa: Check return value of phy_connect_direct()	2017-01-23 15:43:35 -05:00
ethernet	net: make default TX queue length a defined constant	2016-11-07 20:15:55 -05:00
hsr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-10-30 12:42:58 -04:00
ieee802154	Makefile: drop -D__CHECK_ENDIAN__ from cflags	2016-12-16 00:13:43 +02:00
ipv4	tcp: initialize max window for a new fastopen socket	2017-01-19 11:35:26 -05:00
ipv6	ipv6: fix ip6_tnl_parse_tlv_enc_lim()	2017-01-24 14:53:24 -05:00
ipx	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
irda	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
iucv	net/af_iucv: don't use paged skbs for TX on HiperSockets	2017-01-10 21:08:29 -05:00
kcm	Merge branch 'work.splice_read' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-10-07 15:36:58 -07:00
key	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
l2tp	l2tp: take remote address into account in l2tp_ip and l2tp_ip6 socket lookups	2017-01-01 22:07:20 -05:00
l3mdev	net: ipv6: Remove l3mdev_get_saddr6	2016-09-10 23:12:53 -07:00
lapb	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
llc	net: fix sleeping for sk_wait_event()	2016-11-14 13:17:21 -05:00
mac80211	mac80211: don't try to sleep in rate_control_rate_init()	2017-01-24 16:31:54 +01:00
mac802154	ktime: Cleanup ktime_set() usage	2016-12-25 17:21:22 +01:00
mpls	net: mpls: Fix multipath selection for LSR use case	2017-01-23 12:48:14 -05:00
ncsi	net/ncsi: Improve HNCDSC AEN handler	2016-10-20 11:23:08 -04:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2017-01-05 11:49:57 -05:00
netlabel	netlabel: add CALIPSO to the list of built-in protocols	2017-01-06 22:20:45 -05:00
netlink	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
netrom
nfc	genetlink: mark families as __ro_after_init	2016-10-27 16:16:09 -04:00
openvswitch	openvswitch: maintain correct checksum state in conntrack actions	2017-01-15 22:15:16 -05:00
packet	virtio-net: restore VIRTIO_HDR_F_DATA_VALID on receiving	2017-01-20 11:01:17 -05:00
phonet	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
qrtr	net: qrtr: Mark 'buf' as little endian	2017-01-10 20:45:04 -05:00
rds	RDS: use rb_entry()	2016-12-20 14:22:49 -05:00
rfkill
rose	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
rxrpc	rxrpc: abstract away knowledge of IDR internals	2016-12-14 16:04:10 -08:00
sched	net sched actions: fix refcnt when GETing of action after bind	2017-01-16 19:43:19 -05:00
sctp	Revert "net: sctp: fix array overrun read on sctp_timer_tbl"	2017-01-20 11:29:43 -05:00
strparser	strparser: Propagate correct error code in strp_recv()	2016-10-12 01:51:49 -04:00
sunrpc	svcrdma: avoid duplicate dma unmapping during error recovery	2017-01-12 16:14:47 -05:00
switchdev	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-10-30 12:42:58 -04:00
tipc	tipc: add subscription refcount to avoid invalid delete	2017-01-24 16:14:57 -05:00
unix	af_unix: move unix_mknod() out of bindlock	2017-01-24 14:30:56 -05:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2016-12-17 20:17:04 -08:00
wimax	genetlink: mark families as __ro_after_init	2016-10-27 16:16:09 -04:00
wireless	cfg80211: consider VHT opmode on station update	2017-01-11 16:34:25 +01:00
x25	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
xfrm	ktime: Cleanup ktime_set() usage	2016-12-25 17:21:22 +01:00
compat.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
Kconfig	cgroup: move CONFIG_SOCK_CGROUP_DATA to init/Kconfig	2017-01-11 09:47:10 -05:00
Makefile
socket.c	net: socket: Make unnecessarily global sockfs_setattr() static	2017-01-10 11:29:50 -05:00
sysctl_net.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2016-10-06 09:52:23 -07:00