Mao Wenan 91573ae4ae net: rds: Fix NULL ptr use in rds_tcp_kill_sock ... After the commit c4e97b06cf ("net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock()."), it introduced null-ptr-deref in rds_tcp_kill_sock as below: BUG: KASAN: null-ptr-deref on address 0000000000000020 Read of size 8 by task kworker/u16:10/910 CPU: 3 PID: 910 Comm: kworker/u16:10 Not tainted 4.4.178+ #3 Hardware name: linux,dummy-virt (DT) Workqueue: netns cleanup_net Call trace: [<ffffff90080abb50>] dump_backtrace+0x0/0x618 [<ffffff90080ac1a0>] show_stack+0x38/0x60 [<ffffff9008c42b78>] dump_stack+0x1a8/0x230 [<ffffff90085d469c>] kasan_report_error+0xc8c/0xfc0 [<ffffff90085d54a4>] kasan_report+0x94/0xd8 [<ffffff90085d1b28>] __asan_load8+0x88/0x150 [<ffffff9009c9cc2c>] rds_tcp_dev_event+0x734/0xb48 [<ffffff90081eacb0>] raw_notifier_call_chain+0x150/0x1e8 [<ffffff900973fec0>] call_netdevice_notifiers_info+0x90/0x110 [<ffffff9009764874>] netdev_run_todo+0x2f4/0xb08 [<ffffff9009796d34>] rtnl_unlock+0x2c/0x48 [<ffffff9009756484>] default_device_exit_batch+0x444/0x528 [<ffffff9009720498>] ops_exit_list+0x1c0/0x240 [<ffffff9009724a80>] cleanup_net+0x738/0xbf8 [<ffffff90081ca6cc>] process_one_work+0x96c/0x13e0 [<ffffff90081cf370>] worker_thread+0x7e0/0x1910 [<ffffff90081e7174>] kthread+0x304/0x390 [<ffffff9008094280>] ret_from_fork+0x10/0x50 If the first loop add the tc->t_sock = NULL to the tmp_list, 1). list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) then the second loop is to find connections to destroy, tc->t_sock might equal NULL, and tc->t_sock->sk happens null-ptr-deref. 2). list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) Fixes: c4e97b06cf ("net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().") Signed-off-by: Mao Wenan <maowenan@huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-10-05 12:27:38 +02:00
..
af_rds.c
bind.c	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path	2018-04-13 19:50:13 +02:00
cong.c
connection.c
ib.c	RDS: IB: Fix null pointer issue	2018-05-30 07:48:56 +02:00
ib.h
ib_cm.c	rds: ib: add error handle	2017-10-08 10:14:19 +02:00
ib_rdma.c	net: rds: fix memory leak in rds_ib_flush_mr_pool	2019-06-11 12:24:12 +02:00
ib_recv.c
ib_ring.c
ib_send.c	RDS: RDMA: Fix the composite message user notification	2017-10-08 10:14:16 +02:00
ib_stats.c
ib_sysctl.c
info.c
info.h
iw.c
iw.h
iw_cm.c
iw_rdma.c
iw_recv.c
iw_ring.c
iw_send.c
iw_stats.c
iw_sysctl.c
Kconfig
loop.c	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
loop.h
Makefile
message.c
page.c
rdma.c	RDS: null pointer dereference in rds_atomic_free_op	2018-01-17 09:35:29 +01:00
rdma_transport.c
rdma_transport.h
rds.h	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
recv.c	rds: avoid unenecessary cong_update in loop transport	2018-07-22 14:25:54 +02:00
send.c	RDS: RDMA: return appropriate error on rdma map failures	2017-11-30 08:37:25 +00:00
stats.c
sysctl.c
tcp.c	net: rds: Fix NULL ptr use in rds_tcp_kill_sock	2019-10-05 12:27:38 +02:00
tcp.h
tcp_connect.c
tcp_listen.c
tcp_recv.c
tcp_send.c
tcp_stats.c
threads.c
transport.c