NeilBrown eb8d3a2c80 SUNRPC: double free xprt_ctxt while still in use ... When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req. Fixes: 773f91b2cf ("SUNRPC: Fix NFSD's request deferral on RDMA transports") Signed-off-by: NeilBrown <neilb@suse.de> Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>		2023-05-14 15:55:01 -04:00
..
6lowpan	6lowpan: Remove redundant initialisation.	2023-03-29 08:22:52 +01:00
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-02 01:00:31 +00:00
802
8021q	vlan: Add MACsec offload operations for VLAN interface	2023-04-21 08:22:14 +01:00
appletalk
atm	net: annotate lockless accesses to sk->sk_err_soft	2023-03-17 08:25:05 +00:00
ax25
batman-adv	net: vlan: introduce skb_vlan_eth_hdr()	2023-04-23 14:16:44 +01:00
bluetooth	Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running	2023-04-23 22:07:43 -07:00
bpf	bpf: add test_run support for netfilter program type	2023-04-21 11:34:50 -07:00
bpfilter
bridge	bridge: Allow setting per-{Port, VLAN} neighbor suppression state	2023-04-21 08:25:50 +01:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-02 22:22:07 -08:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-06 12:01:20 -07:00
ceph	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
core	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
dcb	net: dcb: add helper functions to retrieve PCP and DSCP rewrite maps	2023-01-20 09:33:22 +00:00
dccp	netfilter: keep conntrack reference until IPsecv6 policy checks are done	2023-03-22 21:50:23 +01:00
devlink	devlink: drop leftover duplicate/unused code	2023-02-20 11:38:35 +00:00
dns_resolver
dsa	net: dsa: tag_ocelot: call only the relevant portion of __skb_vlan_pop() on TX	2023-04-23 14:16:45 +01:00
ethernet
ethtool	net: ethtool: coalesce: try to make user settings stick twice	2023-04-24 18:09:49 -07:00
handshake	net/handshake: Fix section mismatch in handshake_exit	2023-04-21 20:24:57 -07:00
hsr	hsr: ratelimit only when errors are printed	2023-03-16 21:11:03 -07:00
ieee802154	net: ieee802154: remove an unnecessary null pointer check	2023-03-17 09:13:53 +01:00
ife
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
ipv6	net: dst: fix missing initialization of rt_uncached	2023-04-21 20:26:56 -07:00
iucv	net/iucv: Fix size of interrupt data	2023-03-16 17:34:40 -07:00
kcm	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
key	af_key: Fix heap information leak	2023-02-13 09:30:14 +00:00
l2tp	l2tp: generate correct module alias strings	2023-03-31 09:25:12 +01:00
l3mdev
lapb
llc
mac80211	wireless-next patches for v6.4	2023-04-21 07:35:51 -07:00
mac802154	Merge tag 'ieee802154-for-net-next-2023-02-20' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next	2023-02-20 16:40:52 -08:00
mctp	mctp: remove MODULE_LICENSE in non-modules	2023-03-09 23:06:21 -08:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-15 10:26:37 +00:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-20 16:29:51 -07:00
ncsi	net: Use of_property_read_bool() for boolean properties	2023-03-16 17:41:28 +00:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
netlabel
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
netrom	netrom: Fix use-after-free caused by accept on already connected socket	2023-01-30 07:30:47 +00:00
nfc	nfc: change order inside nfc_se_io error path	2023-03-07 13:37:05 -08:00
nsh
openvswitch	net: openvswitch: fix race on port output	2023-04-07 19:42:53 -07:00
packet	net/packet: support mergeable feature of virtio	2023-04-21 12:01:58 +01:00
phonet	net/sock: Introduce trace_sk_data_ready()	2023-01-23 11:26:50 +00:00
psample
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-13 09:35:30 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-02-13 09:33:39 +00:00
rfkill	rfkill: Use sysfs_emit() to instead of sprintf()	2023-02-14 12:21:14 +01:00
rose	net/rose: Fix to not accept on connected socket	2023-01-28 00:19:57 -08:00
rxrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
sched	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-26 10:17:46 +02:00
sctp	sctp: delete the nested flexible array hmac	2023-04-21 08:19:30 +01:00
smc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-04-13 16:04:28 -07:00
strparser
sunrpc	SUNRPC: double free xprt_ctxt while still in use	2023-05-14 15:55:01 -04:00
switchdev
tipc	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
tls	net: tls: fix device-offloaded sendpage straddling records	2023-03-06 13:26:16 -08:00
unix	af_unix: annotate lockless accesses to sk->sk_err	2023-03-17 08:25:05 +00:00
vmw_vsock	vsock/loopback: don't disable irqs for queue access	2023-04-14 11:04:04 +01:00
wireless	Merge wireless/main into wireless-next/main	2023-03-31 11:07:40 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-01-25 09:51:04 +00:00
xdp	bpf-next-for-netdev	2023-04-13 16:43:38 -07:00
xfrm	ipsec-next-2023-04-19	2023-04-19 18:46:17 -07:00
compat.c	net/compat: Update msg_control_is_user when setting a kernel pointer	2023-04-14 11:09:27 +01:00
devres.c
Kconfig	net/handshake: Add Kunit tests for the handshake consumer API	2023-04-19 18:48:48 -07:00
Kconfig.debug
Makefile	net/handshake: Create a NETLINK service for handling handshake requests	2023-04-19 18:48:48 -07:00
socket.c	net: skbuff: hide wifi_acked when CONFIG_WIRELESS not set	2023-04-19 13:04:30 +01:00
sysctl_net.c