linux_dsm_epyc7002/net/rds
Cong Wang cc4dfb7f70 rds: fix two RCU related problems
When a rds sock is bound, it is inserted into the bind_hash_table
which is protected by RCU. But when releasing rds sock, after it
is removed from this hash table, it is freed immediately without
respecting RCU grace period. This could cause some use-after-free
as reported by syzbot.

Mark the rds sock with SOCK_RCU_FREE before inserting it into the
bind_hash_table, so that it would be always freed after a RCU grace
period.

The other problem is in rds_find_bound(), the rds sock could be
freed in between rhashtable_lookup_fast() and rds_sock_addref(),
so we need to extend RCU read lock protection in rds_find_bound()
to close this race condition.

Reported-and-tested-by: syzbot+8967084bcac563795dc6@syzkaller.appspotmail.com
Reported-by: syzbot+93a5839deb355537440f@syzkaller.appspotmail.com
Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Cc: rds-devel@oss.oracle.com
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oarcle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-09-12 00:09:19 -07:00
..
af_rds.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
bind.c rds: fix two RCU related problems 2018-09-12 00:09:19 -07:00
cong.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
connection.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
ib_cm.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
ib_fmr.c
ib_frmr.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_mr.h Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_rdma.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
ib_recv.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_ring.c
ib_send.c Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
ib_stats.c
ib_sysctl.c
ib.c net/rds: Use rdma_read_gids to get connection SGID/DGID in IPv6 2018-08-27 15:26:01 -07:00
ib.h rds: rds_ib_recv_alloc_cache() should call alloc_percpu_gfp() instead 2018-08-01 09:32:35 -07:00
info.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
info.h
Kconfig net/rds: RDS is not Radio Data System 2018-08-31 23:09:53 -07:00
loop.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
loop.h rds: clean up loopback rds_connections on netns deletion 2018-06-27 10:11:03 +09:00
Makefile rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00
message.c rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00
page.c
rdma_transport.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
rdma_transport.h rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
rdma.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
rds_single_path.h
rds.h Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
recv.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
send.c Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net 2018-08-02 10:55:32 -07:00
stats.c
sysctl.c
tcp_connect.c rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
tcp_listen.c rds: Remove IPv6 dependency 2018-08-01 09:32:35 -07:00
tcp_recv.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
tcp_send.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
tcp_stats.c
tcp.c rds: tcp: remove duplicated include from tcp.c 2018-08-21 09:50:53 -07:00
tcp.h rds: Enable RDS IPv6 support 2018-07-23 21:17:44 -07:00
threads.c rds: Changing IP address internal representation to struct in6_addr 2018-07-23 21:17:44 -07:00
transport.c rds: remove trailing whitespace and blank lines 2018-07-24 14:10:42 -07:00