mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/net/tipc
History
Ying Xue c756891a4e tipc: fix oops when creating server socket fails 
When creation of TIPC internal server socket fails,
we get an oops with the following dump:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
IP: [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc]
PGD 13719067 PUD 12008067 PMD 0
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
Modules linked in: tipc(+)
CPU: 4 PID: 4340 Comm: insmod Not tainted 3.10.0+ #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
task: ffff880014360000 ti: ffff88001374c000 task.ti: ffff88001374c000
RIP: 0010:[<ffffffffa0011f49>]  [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc]
RSP: 0018:ffff88001374dc98  EFLAGS: 00010292
RAX: 0000000000000000 RBX: ffff880012ac09d8 RCX: 0000000000000000
RDX: 0000000000000046 RSI: 0000000000000001 RDI: ffff880014360000
RBP: ffff88001374dcb8 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0016fa0
R13: ffffffffa0017010 R14: ffffffffa0017010 R15: ffff880012ac09d8
FS:  0000000000000000(0000) GS:ffff880016600000(0063) knlGS:00000000f76668d0
CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
CR2: 0000000000000020 CR3: 0000000012227000 CR4: 00000000000006e0
Stack:
ffff88001374dcb8 ffffffffa0016fa0 0000000000000000 0000000000000001
ffff88001374dcf8 ffffffffa0012922 ffff88001374dce8 00000000ffffffea
ffffffffa0017100 0000000000000000 ffff8800134241a8 ffffffffa0017150
Call Trace:
[<ffffffffa0012922>] tipc_server_stop+0xa2/0x1b0 [tipc]
[<ffffffffa0009995>] tipc_subscr_stop+0x15/0x20 [tipc]
[<ffffffffa00130f5>] tipc_core_stop+0x1d/0x33 [tipc]
[<ffffffffa001f0d4>] tipc_init+0xd4/0xf8 [tipc]
[<ffffffffa001f000>] ? 0xffffffffa001efff
[<ffffffff8100023f>] do_one_initcall+0x3f/0x150
[<ffffffff81082f4d>] ? __blocking_notifier_call_chain+0x7d/0xd0
[<ffffffff810cc58a>] load_module+0x11aa/0x19c0
[<ffffffff810c8d60>] ? show_initstate+0x50/0x50
[<ffffffff8190311c>] ? retint_restore_args+0xe/0xe
[<ffffffff810cce79>] SyS_init_module+0xd9/0x110
[<ffffffff8190dc65>] sysenter_dispatch+0x7/0x1f
Code: 6c 24 70 4c 89 ef e8 b7 04 8f e1 8b 73 04 4c 89 e7 e8 7c 9e 32 e1 41 83 ac 24
b8 00 00 00 01 4c 89 ef e8 eb 0a 8f e1 48 8b 43 08 <4c> 8b 68 20 4d 8d a5 48 03 00
00 4c 89 e7 e8 04 05 8f e1 4c 89
RIP  [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc]
RSP <ffff88001374dc98>
CR2: 0000000000000020
---[ end trace b02321f40e4269a3 ]---

We have the following call chain:

tipc_core_start()
    ret = tipc_subscr_start()
        ret = tipc_server_start(){
                  server->enabled = 1;
                  ret = tipc_open_listening_sock()
              }

I.e., the server->enabled flag is unconditionally set to 1, whatever
the return value of tipc_open_listening_sock().

This causes a crash when tipc_core_start() tries to clean up
resources after a failed initialization:

    if (ret == failed)
        tipc_subscr_stop()
            tipc_server_stop(){
                if (server->enabled)
                    tipc_close_conn(){
                        NULL reference of con->sock-sk
                        OOPS!
                }
            }

To avoid this, tipc_server_start() should only set server->enabled
to 1 in case of a succesful socket creation. In case of failure, it
should release all allocated resources before returning.

Problem introduced in commit c5fa7b3cf3
("tipc: introduce new TIPC server infrastructure") in v3.11-rc1.
Note that it won't be seen often; it takes a module load under memory
constrained conditions in order to trigger the failure condition.

Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
 		2013-08-01 15:54:33 -07:00
..
Kconfig tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
Makefile tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
addr.c tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
addr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
bcast.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
bcast.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
bearer.c tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
bearer.h tipc: add InfiniBand media type 2013-04-17 14:18:33 -04:00
config.c tipc: convert config_lock from spinlock to mutex 2013-06-17 15:53:01 -07:00
config.h tipc: Optimize re-initialization of configuration service 2012-04-26 17:19:07 -04:00
core.c tipc: convert configuration server to use new server facility 2013-06-17 15:53:00 -07:00
core.h tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
discover.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
discover.h tipc: rename struct link* to struct tipc_link* 2011-12-29 21:53:30 -05:00
eth_media.c tipc: remove dev_base_lock use from enable_bearer 2013-06-17 15:53:01 -07:00
handler.c tipc: do not use tasklet_disable before tasklet_kill 2012-11-03 15:10:14 -04:00
ib_media.c net/tipc: use %*phC to dump small buffers in hex form 2013-07-11 17:03:36 -07:00
link.c tipc: fix wrong return value for link_send_sections_long routine 2013-06-17 15:53:01 -07:00
link.h tipc: remove the bearer congestion mechanism 2012-11-21 20:07:25 -05:00
log.c tipc: remove print_buf and deprecated log buffer code 2012-07-13 19:34:43 -04:00
msg.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
msg.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
name_distr.c tipc: eliminate an unnecessary cast of node variable 2012-11-22 14:33:28 -05:00
name_distr.h
…
name_table.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
name_table.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
net.c tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
net.h tipc: change tipc_net_start routine return value type 2012-08-20 02:26:30 -07:00
netlink.c net-next: replace obsolete NLMSG_* with type safe nlmsg_* 2013-03-28 14:25:25 -04:00
node.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
node.h tipc: rename supported flag to recv_permitted 2012-11-22 07:50:51 -05:00
node_subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
node_subscr.h tipc: compress out gratuitous extra carriage returns 2012-04-30 15:53:56 -04:00
port.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
port.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
ref.c tipc: use standard printk shortcut macros (pr_err etc.) 2012-07-13 19:24:44 -04:00
ref.h tipc: cleanup function namespace 2010-10-16 11:13:24 -07:00
server.c tipc: fix oops when creating server socket fails 2013-08-01 15:54:33 -07:00
server.h tipc: introduce new TIPC server infrastructure 2013-06-17 15:53:00 -07:00
socket.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
subscr.c tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
subscr.h tipc: cosmetic realignment of function arguments 2013-06-17 15:53:01 -07:00
sysctl.c tipc: change socket buffer overflow control to respect sk_rcvbuf 2013-06-17 15:53:00 -07:00