linux-stable/net/llc
Cong Wang f7e4367268 llc: hold llc_sap before release_sock()
syzbot reported we still access llc->sap in llc_backlog_rcv()
after it is freed in llc_sap_remove_socket():

Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430
 llc_conn_ac_send_sabme_cmd_p_set_x+0x3a8/0x460 net/llc/llc_c_ac.c:785
 llc_exec_conn_trans_actions net/llc/llc_conn.c:475 [inline]
 llc_conn_service net/llc/llc_conn.c:400 [inline]
 llc_conn_state_process+0x4e1/0x13a0 net/llc/llc_conn.c:75
 llc_backlog_rcv+0x195/0x1e0 net/llc/llc_conn.c:891
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2335
 release_sock+0xa4/0x2b0 net/core/sock.c:2850
 llc_ui_release+0xc8/0x220 net/llc/af_llc.c:204

llc->sap is refcount'ed and llc_sap_remove_socket() is paired
with llc_sap_add_socket(). This can be amended by holding its refcount
before llc_sap_remove_socket() and releasing it after release_sock().

Reported-by: <syzbot+6e181fc95081c2cf9051@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-04-19 13:54:53 -04:00
..
af_llc.c llc: hold llc_sap before release_sock() 2018-04-19 13:54:53 -04:00
Kconfig
llc_c_ac.c llc: properly handle dev_queue_xmit() return value 2018-03-27 11:56:00 -04:00
llc_c_ev.c
llc_c_st.c llc: Make llc_conn_ev_qfyr_t function pointer arrays const 2014-12-10 15:21:24 -05:00
llc_conn.c llc: properly handle dev_queue_xmit() return value 2018-03-27 11:56:00 -04:00
llc_core.c net, llc: convert llc_sap.refcnt from atomic_t to refcount_t 2017-07-04 22:35:15 +01:00
llc_if.c net: llc: include linux/errno.h instead of asm/errno.h 2014-10-24 15:51:42 -04:00
llc_input.c locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() 2017-10-25 11:01:08 +02:00
llc_output.c llc: remove noisy WARN from llc_mac_hdr_init 2014-01-28 18:01:32 -08:00
llc_pdu.c
llc_proc.c net: Use octal not symbolic permissions 2018-03-26 12:07:48 -04:00
llc_s_ac.c
llc_s_ev.c
llc_s_st.c llc: Make llc_sap_action_t function pointer arrays const 2014-12-10 15:21:24 -05:00
llc_sap.c net: llc: drop VLA in llc_sap_mcast() 2018-03-12 11:14:06 -04:00
llc_station.c llc2: Collapse remainder of state machine into simple if-else if-statement 2012-09-17 13:04:19 -04:00
Makefile
sysctl_net_llc.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00