David Howells 43159c9ec1 rxrpc: Fix call ref leak ... commit c48fc11b69 upstream. When sendmsg() finds a call to continue on with, if the call is in an inappropriate state, it doesn't release the ref it just got on that call before returning an error. This causes the following symptom to show up with kasan: BUG: KASAN: use-after-free in rxrpc_send_keepalive+0x8a2/0x940 net/rxrpc/output.c:635 Read of size 8 at addr ffff888064219698 by task kworker/0:3/11077 where line 635 is: whdr.epoch = htonl(peer->local->rxnet->epoch); The local endpoint (which cannot be pinned by the call) has been released, but not the peer (which is pinned by the call). Fix this by releasing the call in the error path. Fixes: 37411cad63 ("rxrpc: Fix potential NULL-pointer exception") Reported-by: syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-06 12:43:37 +01:00
..
af_rxrpc.c
ar-internal.h
call_accept.c
call_event.c
call_object.c
conn_client.c
conn_event.c
conn_object.c
conn_service.c
input.c
insecure.c
Kconfig
key.c
local_event.c
local_object.c
Makefile
misc.c
net_ns.c
output.c
peer_event.c
peer_object.c
proc.c
protocol.h
recvmsg.c
rxkad.c
security.c
sendmsg.c
skbuff.c
sysctl.c
utils.c