Eric Dumazet 2d327a79ee llc: only change llc->dev when bind() succeeds ... My latest patch, attempting to fix the refcount leak in a minimal way turned out to add a new bug. Whenever the bind operation fails before we attempt to grab a reference count on a device, we might release the device refcount of a prior successful bind() operation. syzbot was not happy about this [1]. Note to stable teams: Make sure commit b37a466837 ("netdevice: add the case if dev is NULL") is already present in your trees. [1] general protection fault, probably for non-canonical address 0xdffffc0000000070: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000380-0x0000000000000387] CPU: 1 PID: 3590 Comm: syz-executor361 Tainted: G W 5.17.0-syzkaller-04796-g169e77764adc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:llc_ui_connect+0x400/0xcb0 net/llc/af_llc.c:500 Code: 80 3c 02 00 0f 85 fc 07 00 00 4c 8b a5 38 05 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 80 03 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a9 07 00 00 49 8b b4 24 80 03 00 00 4c 89 f2 48 RSP: 0018:ffffc900038cfcc0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8880756eb600 RCX: 0000000000000000 RDX: 0000000000000070 RSI: ffffc900038cfe3e RDI: 0000000000000380 RBP: ffff888015ee5000 R08: 0000000000000001 R09: ffff888015ee5535 R10: ffffed1002bdcaa6 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc900038cfe37 R14: ffffc900038cfe38 R15: ffff888015ee5012 FS: 0000555555acd300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000280 CR3: 0000000077db6000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __sys_connect_file+0x155/0x1a0 net/socket.c:1900 __sys_connect+0x161/0x190 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x6f/0xb0 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f016acb90b9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd417947f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f016acb90b9 RDX: 0000000000000010 RSI: 0000000020000140 RDI: 0000000000000003 RBP: 00007f016ac7d0a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f016ac7d130 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:llc_ui_connect+0x400/0xcb0 net/llc/af_llc.c:500 Fixes: 764f4eb684 ("llc: fix netdevice reference leaks in llc_ui_bind()") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: 赵子轩 <beraphin@gmail.com> Cc: Stoyan Manolov <smanolov@suse.de> Link: https://lore.kernel.org/r/20220325035827.360418-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2022-03-25 16:55:41 -07:00
..
6lowpan	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
9p	xen/9p: use alloc/free_pages_exact()	2022-03-07 09:48:55 +01:00
802
8021q	vlan: use correct format characters	2022-03-17 16:34:49 -07:00
appletalk
atm
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
batman-adv	batman-adv: Use netif_rx().	2022-03-07 11:40:41 +00:00
bluetooth	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed	2022-03-18 17:12:08 +01:00
bpf	bpf, test_run: Fix packet size check for live packet mode	2022-03-11 22:01:26 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	net: bridge: mst: Restrict info size queries to bridge ports	2022-03-23 10:32:44 -07:00
caif	net: caif: Use netif_rx().	2022-03-04 12:02:19 +00:00
can	can: isotp: support MSG_TRUNC flag when reading from socket	2022-03-16 21:41:40 +01:00
ceph	libceph: optionally use bounce buffer on recv path in crc mode	2022-02-02 18:50:36 +01:00
core	Networking changes for 5.18.	2022-03-24 13:13:26 -07:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp	dccp: remove max48()	2022-01-27 13:53:27 +00:00
decnet	net: decnet: use time_is_before_jiffies() instead of open coding it	2022-02-28 13:21:32 +00:00
dns_resolver
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ethernet
ethtool	ethtool: add support to set/get completion queue event size	2022-02-23 20:33:05 -08:00
hsr	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
ieee802154	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
ife
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ipv6	netfilter: nft_fib: add reduce support	2022-03-20 00:29:47 +01:00
iucv	s390/iucv: sort out physical vs virtual pointers usage	2022-02-22 16:09:13 -08:00
kcm
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-03-10 07:39:47 +01:00
l2tp
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	mac80211: update bssid_indicator in ieee80211_assign_beacon	2022-03-15 11:50:33 +01:00
mac802154
mctp	mctp: Avoid warning if unregister notifies twice	2022-02-25 22:23:23 -08:00
mpls	net: mpls: Fix GCC 12 warning	2022-02-10 15:29:39 +00:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ncsi
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	af_netlink: Fix shift out of bounds in group mask calculation	2022-03-18 21:47:14 -07:00
netrom
nfc	nfc: llcp: Revert "NFC: Keep socket alive until the DISC PDU is actually sent"	2022-03-03 10:43:37 +00:00
nsh
openvswitch	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-17 13:56:58 -07:00
phonet	phonet: Use netif_rx().	2022-03-07 11:40:41 +00:00
psample
qrtr
rds
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose
rxrpc
sched	net/sched: add vlan push_eth and pop_eth action to the hardware IR	2022-03-16 19:59:36 -07:00
sctp	selinux/stable-5.18 PR 20220321	2022-03-21 20:47:54 -07:00
smc	net/smc: fix -Wmissing-prototypes warning when CONFIG_SYSCTL not set	2022-03-09 20:02:35 -08:00
strparser
sunrpc	Networking changes for 5.18.	2022-03-24 13:13:26 -07:00
switchdev	net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device	2022-02-24 21:31:43 -08:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
tls	net/tls: optimize judgement processes in tls_set_device_offload()	2022-03-21 14:58:16 -07:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-03-24 18:36:36 -07:00
wireless	brcmfmac	2022-03-11 13:00:17 -08:00
x25
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/	2022-03-19 14:49:08 +00:00
compat.c
devres.c
Kconfig	page_pool: Add allocation stats	2022-03-03 09:55:28 +00:00
Kconfig.debug
Makefile
socket.c	fs: allocate inode by using alloc_inode_sb()	2022-03-22 15:57:03 -07:00
sysctl_net.c