Ka-Cheong Poon 84eef2b218 rds: Incorrect reference counting in TCP socket creation ... Commit 0933a578cd ("rds: tcp: use sock_create_lite() to create the accept socket") has a reference counting issue in TCP socket creation when accepting a new connection. The code uses sock_create_lite() to create a kernel socket. But it does not do __module_get() on the socket owner. When the connection is shutdown and sock_release() is called to free the socket, the owner's reference count is decremented and becomes incorrect. Note that this bug only shows up when the socket owner is configured as a kernel module. v2: Update comments Fixes: 0933a578cd ("rds: tcp: use sock_create_lite() to create the accept socket") Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com> Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com> Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-03-02 09:40:27 -05:00
..
af_rds.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
bind.c	rds; Reset rs->rs_bound_addr in rds_add_bound() failure path	2017-12-27 13:37:27 -05:00
cong.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
connection.c	rds: do not call ->conn_alloc with GFP_KERNEL	2018-02-13 13:52:02 -05:00
ib_cm.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
ib_fmr.c
ib_frmr.c
ib_mr.h
ib_rdma.c
ib_recv.c
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
ib.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
ib.h
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c
page.c
rdma_transport.c
rdma_transport.h
rdma.c	RDS: null pointer dereference in rds_atomic_free_op	2018-01-04 14:19:26 -05:00
rds_single_path.h
rds.h	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
recv.c
send.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
stats.c
sysctl.c
tcp_connect.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_listen.c	rds: Incorrect reference counting in TCP socket creation	2018-03-02 09:40:27 -05:00
tcp_recv.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_send.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp_stats.c
tcp.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
tcp.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-01-23 13:51:56 -05:00
threads.c	rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management	2018-02-08 15:23:52 -05:00
transport.c