evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_oneplus_msm8998/net/core
History
Sharath Chandra Vurukala 4d2f6ab9a8 net: sockev: avoid races between sockev and socket_close 
Use-after-free is seen when sending a sockev netlink message
since socket is not held which can race with sk_free.

KASAN: use-after-free in sockev_client_cb+0x41c/0x4b8
	in net/core/sockev_nlmcast.c:104
Read of size 2 at addr ffffffc08420c550
Call trace:
dump_backtrace+0x0/0x388 arch/arm64/kernel/time.c:55
show_stack+0x24/0x30 arch/arm64/kernel/traps.c:152
__dump_stack+0x24/0x2c lib/dump_stack.c:17
dump_stack+0x8c/0xd0 lib/dump_stack.c:53
print_address_description+0x74/0x234 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report+0x240/0x264 mm/kasan/report.c:412
__asan_report_load2_noabort+0x2c/0x38 mm/kasan/report.c:431
sockev_client_cb+0x41c/0x4b8 net/core/sockev_nlmcast.c:104
notifier_call_chain+0x104/0x158 kernel/notifier.c:93
__blocking_notifier_call_chain+0x80/0xb0 kernel/notifier.c:317
blocking_notifier_call_chain+0x3c/0x4c kernel/notifier.c:328
sockev_notify+0x30/0x3c net/socket.c:181
SYSC_bind net/socket.c:1509 [inline]
SyS_bind+0x1ec/0x30c net/socket.c:1489
el0_svc_naked+0x34/0x38
Freed by task 19460:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
__kasan_slab_free+0x134/0x20c mm/kasan/kasan.c:520
kasan_slab_free+0x10/0x1c mm/kasan/kasan.c:527
slab_free_hook mm/slub.c:1401 [inline]
slab_free_freelist_hook mm/slub.c:1422 [inline]
slab_free mm/slub.c:2979 [inline]
kmem_cache_free+0x114/0x664 mm/slub.c:3001
sk_prot_free net/core/sock.c:1504 [inline]
__sk_destruct+0x324/0x3c0 net/core/sock.c:1585
__sk_free+0x180/0x200 net/core/sock.c:1601
sk_free+0x44/0x50 net/core/sock.c:1612
sock_put include/net/sock.h:1643 [inline]
sk_common_release+0x198/0x20c net/core/sock.c:3014
raw_close+0x38/0x44 net/ipv4/raw.c:703
inet_release+0x128/0x15c net/ipv4/af_inet.c:446
__sock_release+0xb8/0x258 net/socket.c:614
sock_close+0x24/0x34 net/socket.c:1150
__fput+0x1f4/0x4e4 fs/file_table.c:345
____fput+0x20/0x2c fs/file_table.c:380
task_work_run+0x9c/0x174 kernel/task_work.c:113

Change-Id: Idb4335889b6e4228f36d76ca5b6156cc5e5838da
Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>
2019-05-20 15:51:25 +05:30
..
datagram.c net: rename SOCK_ASYNC_NOSPACE and SOCK_ASYNC_WAITDATA 2015-12-01 15:45:05 -05:00
dev.c Merge android-4.4.153 (5e24b4e) into msm-4.4 2018-08-28 17:28:39 +05:30
dev_addr_lists.c net: fix uninit-value in __hw_addr_add_ex() 2018-05-16 10:06:50 +02:00
dev_ioctl.c net: Zero terminate ifr_name in dev_ifname(). 2017-08-11 09:08:52 -07:00
drop_monitor.c drop_monitor: consider inserted data in genlmsg_end 2017-01-15 13:41:35 +01:00
dst.c Fix an intermittent pr_emerg warning about lo becoming free. 2017-07-05 14:37:13 +02:00
dst_cache.c net: dst_cache_per_cpu_dst_set() can be static 2018-02-25 11:03:55 +01:00
ethtool.c ethtool: do not vzalloc(0) on registers dump 2017-06-17 06:39:36 +02:00
fib_rules.c net: core: add UID to flows, rules, and routes 2017-01-02 14:06:47 +05:30
filter.c bpf: fix 32-bit divide by zero 2018-02-03 17:04:25 +01:00
flow.c flow: Move __get_hash_from_flowi{4,6} into flow_dissector.c 2015-09-01 17:00:24 -07:00
flow_dissector.c net: Include additional rmnet header in flow_dissector 2018-09-04 18:35:04 -07:00
gen_estimator.c net_sched: gen_estimator: extend pps limit 2015-07-08 13:59:20 -07:00
gen_stats.c
link_watch.c
lwtunnel.c dst: Pass net into dst->output 2015-10-08 04:27:03 -07:00
Makefile Merge android-4.4.118 (5f7f76a) into msm-4.4 2018-03-01 17:20:34 +05:30
neighbour.c Merge android-4.4.131 (d5d6526) into msm-4.4 2018-05-03 15:53:14 +05:30
net-procfs.c net: add a per-cpu counter for the number of frames coalesced in GRO 2016-03-22 11:09:45 -07:00
net-sysfs.c switchdev: rename SWITCHDEV_ATTR_* enum values to SWITCHDEV_ATTR_ID_* 2015-10-03 04:49:37 -07:00
net-sysfs.h
net-traces.c net: FIB tracepoints 2015-08-29 13:05:16 -07:00
net_namespace.c net: move somaxconn init from sysctl code 2018-04-13 19:50:11 +02:00
netclassid_cgroup.c Merge branch 'master' into for-4.4-fixes 2015-12-07 10:09:03 -05:00
netevent.c
netpoll.c UPSTREAM: netpoll: Fix device name check in netpoll_setup() 2018-05-04 20:25:10 +00:00
netprio_cgroup.c cgroup: fix handling of multi-destination migration from subtree_control enabling 2015-12-03 10:18:21 -05:00
pktgen.c net: pktgen: remove rcu locking in pktgen_change_name() 2016-11-15 07:46:38 +01:00
ptp_classifier.c ptp: Change ptp_class to a proper bitmask 2015-11-03 11:08:22 -05:00
request_sock.c tcp: restore fastopen operations 2015-10-05 03:19:06 -07:00
rtnetlink.c rtnetlink: add rtnl_link_state check in rtnl_configure_link 2018-07-28 07:45:02 +02:00
scm.c unix: correctly track in-flight fds in sending process user_struct 2016-03-03 15:07:05 -08:00
secure_seq.c
skbuff.c Merge android-4.4.144 (4b2d6ba) into msm-4.4 2018-08-03 17:05:13 +05:30
sock.c Merge android-4.4.133 (3f51ea2) into msm-4.4 2018-05-31 12:28:38 +05:30
sock_diag.c This is the 4.4.112 stable release 2018-01-17 10:14:26 +01:00
sockev_nlmcast.c net: sockev: avoid races between sockev and socket_close 2019-05-20 15:51:25 +05:30
stream.c net: fix sock_wake_async() rcu protection 2015-12-01 15:45:05 -05:00
sysctl_net_core.c net: move somaxconn init from sysctl code 2018-04-13 19:50:11 +02:00
timestamping.c net: skb_defer_rx_timestamp should check for phydev before setting up classify 2015-07-09 14:17:15 -07:00
tso.c net: tso: add support for IPv6 2015-10-26 22:24:22 -07:00
utils.c net: move net_get_random_once to lib 2015-10-08 05:26:35 -07:00