Eric Dumazet b357a364c5 inet: fix possible panic in reqsk_queue_unlink() ... [ 3897.923145] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [ 3897.931025] IP: [<ffffffffa9f27686>] reqsk_timer_handler+0x1a6/0x243 There is a race when reqsk_timer_handler() and tcp_check_req() call inet_csk_reqsk_queue_unlink() on the same req at the same time. Before commit fa76ce7328 ("inet: get rid of central tcp/dccp listener timer"), listener spinlock was held and race could not happen. To solve this bug, we change reqsk_queue_unlink() to not assume req must be found, and we return a status, to conditionally release a refcount on the request sock. This also means tcp_check_req() in non fastopen case might or not consume req refcount, so tcp_v6_hnd_req() & tcp_v4_hnd_req() have to properly handle this. (Same remark for dccp_check_req() and its callers) inet_csk_reqsk_queue_drop() is now too big to be inlined, as it is called 4 times in tcp and 3 times in dccp. Fixes: fa76ce7328 ("inet: get rid of central tcp/dccp listener timer") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-04-24 11:39:15 -04:00
..
6lowpan	6lowpan: nhc: add other known rfc6282 compressions	2015-02-14 23:08:44 +01:00
9p	9p: patches for 4.1 merge window	2015-04-18 17:45:30 -04:00
802	net: Kill dev_rebuild_header	2015-03-02 16:43:41 -05:00
8021q	vlan: implement ndo_get_iflink	2015-04-02 14:05:00 -04:00
appletalk	appletalk: Use eth_<foo>_addr instead of memset	2015-03-03 17:01:37 -05:00
atm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-15 09:00:47 -07:00
ax25	ax25: Fix the build when CONFIG_INET is disabled	2015-03-05 13:17:39 -05:00
batman-adv	dev: introduce dev_get_iflink()	2015-04-02 14:04:59 -04:00
bluetooth	Bluetooth: hidp: Fix regression with older userspace and flags validation	2015-04-18 11:01:08 -04:00
bridge	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
caif	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-03-20 18:51:09 -04:00
can	can: introduce new raw socket option to join the given CAN filters	2015-04-01 11:28:22 +02:00
ceph	Revert "libceph: use memalloc flags for net IO"	2015-04-07 19:08:35 +03:00
core	net: do not deplete pfmemalloc reserve	2015-04-22 16:24:59 -04:00
dcb	net/dcb: Add IEEE QCN attribute	2015-03-06 21:50:02 -05:00
dccp	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
decnet	netfilter: Pass socket pointer down through okfn().	2015-04-07 15:25:55 -04:00
dns_resolver
dsa	net: dsa: use DEVICE_ATTR_RW to declare temp1_max	2015-04-17 15:58:37 -04:00
ethernet	ethernet: Use eth_<foo>_addr instead of memset	2015-03-03 17:01:38 -05:00
hsr	net/hsr: Fix NULL pointer dereference and refcnt bugs when deleting a HSR interface.	2015-03-01 13:40:23 -05:00
ieee802154	ieee802154: don't export static symbol	2015-03-14 17:11:31 +01:00
ipv4	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
ipv6	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
ipx	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
irda	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-03-09 23:38:02 -04:00
iucv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-04-02 16:16:53 -04:00
key	xfrm: simplify xfrm_address_t use	2015-03-31 13:58:35 -04:00
l2tp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-04-06 22:34:15 -04:00
lapb	lapb: move EXPORT_SYMBOL after functions.	2014-10-24 15:51:42 -04:00
llc	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-15 09:00:47 -07:00
mac802154	mac802154: cleanup concurrent check	2015-03-27 19:18:50 +01:00
mpls	mpls: Prevent use of implicit NULL label as outgoing label	2015-04-22 14:24:54 -04:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2015-04-14 18:51:19 -04:00
netlabel	netlink: implement nla_put_in_addr and nla_put_in6_addr	2015-03-31 13:58:35 -04:00
netlink	rhashtable: provide len to obj_hashfn	2015-03-25 17:18:33 +01:00
netrom	net: Kill dev_rebuild_header	2015-03-02 16:43:41 -05:00
nfc	nfc: Fix portid type in urelease_work	2015-04-13 16:35:16 -04:00
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-15 09:00:47 -07:00
packet	af_packet: pass checksum validation status to the user	2015-03-23 22:01:28 -04:00
phonet	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-04-14 15:44:14 -04:00
rfkill	Last round of updates for net-next:	2015-02-04 14:57:45 -08:00
rose	net: Kill dev_rebuild_header	2015-03-02 16:43:41 -05:00
rxrpc	new helper: msg_data_left()	2015-04-11 15:53:35 -04:00
sched	act_mirred: Fix bogus header when redirecting from VLAN	2015-04-17 13:29:28 -04:00
sctp	sctp: avoid to repeatedly declare external variables	2015-03-25 11:40:16 -04:00
sunrpc	lib/string_helpers.c: change semantics of string_escape_mem	2015-04-15 16:35:24 -07:00
switchdev	switchdev: fix stp update API to work with layered netdevices	2015-03-23 16:44:56 -04:00
tipc	tipc: fix node refcount issue	2015-04-23 11:50:34 -04:00
unix	net: unix: garbage: fixed several comment and whitespace style issues	2015-04-23 13:15:20 -04:00
vmw_vsock	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
wimax
wireless	cfg80211: don't allow disabling WEXT if it's required	2015-04-08 09:19:29 +02:00
x25	net: Remove iocb argument from sendmsg and recvmsg	2015-03-02 13:06:31 -05:00
xfrm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-04-14 15:44:14 -04:00
compat.c	net: switch importing msghdr from userland to {compat_,}import_iovec()	2015-04-09 00:02:26 -04:00
Kconfig	kconfig: use bool instead of boolean for type definition attributes	2015-01-07 13:08:04 +01:00
Makefile	mpls: Refactor how the mpls module is built	2015-03-04 00:26:06 -05:00
socket.c	make new_sync_{read,write}() static	2015-04-11 22:29:40 -04:00
sysctl_net.c