Allison Henderson 124f20c5f6 net:rds: Fix possible deadlock in rds_message_put ... commit f1acf1ac84 upstream. Functions rds_still_queued and rds_clear_recv_queue lock a given socket in order to safely iterate over the incoming rds messages. However calling rds_inc_put while under this lock creates a potential deadlock. rds_inc_put may eventually call rds_message_purge, which will lock m_rs_lock. This is the incorrect locking order since m_rs_lock is meant to be locked before the socket. To fix this, we move the message item to a local list or variable that wont need rs_recv_lock protection. Then we can safely call rds_inc_put on any item stored locally after rs_recv_lock is released. Fixes: bdbe6fbc6a ("RDS: recv.c") Reported-by: syzbot+f9db6ff27b9bfdcfeca0@syzkaller.appspotmail.com Reported-by: syzbot+dcd73ff9291e6d34b3ab@syzkaller.appspotmail.com Signed-off-by: Allison Henderson <allison.henderson@oracle.com> Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@oracle.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-09-04 13:23:39 +02:00
..
af_rds.c	net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv	2024-02-23 08:54:27 +01:00
bind.c
cong.c
connection.c
ib_cm.c
ib_frmr.c
ib_mr.h
ib_rdma.c
ib_recv.c	rds: add missing barrier to release_refill	2022-08-25 11:39:54 +02:00
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
ib.c
ib.h
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:39:16 +01:00
page.c
rdma_transport.c	net: rds: Fix possible NULL-pointer dereference	2023-10-06 13:18:08 +02:00
rdma_transport.h
rdma.c	net/rds: fix possible cp null dereference	2024-04-10 16:19:37 +02:00
rds_single_path.h
rds.h
recv.c	net:rds: Fix possible deadlock in rds_message_put	2024-09-04 13:23:39 +02:00
send.c	rds: introduce acquire/release ordering in acquire/release_in_xmit()	2024-03-26 18:21:36 -04:00
stats.c
sysctl.c
tcp_connect.c	net: prevent address rewrite in kernel_bind()	2023-10-19 23:05:33 +02:00
tcp_listen.c	net: prevent address rewrite in kernel_bind()	2023-10-19 23:05:33 +02:00
tcp_recv.c
tcp_send.c
tcp_stats.c
tcp.c	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()	2022-10-26 12:34:49 +02:00
tcp.h
threads.c
transport.c