Eric Dumazet b357a364c5 inet: fix possible panic in reqsk_queue_unlink() ... [ 3897.923145] BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 [ 3897.931025] IP: [<ffffffffa9f27686>] reqsk_timer_handler+0x1a6/0x243 There is a race when reqsk_timer_handler() and tcp_check_req() call inet_csk_reqsk_queue_unlink() on the same req at the same time. Before commit fa76ce7328 ("inet: get rid of central tcp/dccp listener timer"), listener spinlock was held and race could not happen. To solve this bug, we change reqsk_queue_unlink() to not assume req must be found, and we return a status, to conditionally release a refcount on the request sock. This also means tcp_check_req() in non fastopen case might or not consume req refcount, so tcp_v6_hnd_req() & tcp_v4_hnd_req() have to properly handle this. (Same remark for dccp_check_req() and its callers) inet_csk_reqsk_queue_drop() is now too big to be inlined, as it is called 4 times in tcp and 3 times in dccp. Fixes: fa76ce7328 ("inet: get rid of central tcp/dccp listener timer") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Yuchung Cheng <ycheng@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-04-24 11:39:15 -04:00
..
acpi	ACPICA updates for v4.1-rc1	2015-04-17 15:01:29 -04:00
asm-generic	TTY/Serial patches for 4.1-rc1	2015-04-21 09:33:10 -07:00
clocksource
crypto	Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2015-04-15 10:42:15 -07:00
drm	Merge tag 'topic/drm-misc-2015-04-15' of git://anongit.freedesktop.org/drm-intel into drm-next	2015-04-16 08:34:24 +10:00
dt-bindings	ARM: SoC multiplatform code changes for v4.1	2015-04-22 09:20:15 -07:00
keys
kvm	KVM/ARM changes for v4.1:	2015-04-07 18:09:20 +02:00
linux	rhashtable: don't attempt to grow when at max_size	2015-04-24 11:38:12 -04:00
math-emu
media	Merge branch 'patchwork' into v4l_for_linus	2015-04-21 06:12:35 -03:00
memory
misc
net	inet: fix possible panic in reqsk_queue_unlink()	2015-04-24 11:39:15 -04:00
pcmcia
ras
rdma
rxrpc	RxRPC: Handle VERSION Rx protocol packets	2015-04-01 16:31:26 +01:00
scsi	SCSI misc on 20150416	2015-04-16 19:02:04 -04:00
soc
sound	ASoC: Updates for v4.1	2015-04-13 14:14:29 +02:00
target
trace	The changes to the common clock framework for 4.0 are mostly new clock	2015-04-21 09:24:09 -07:00
uapi	media updates for v4.1-rc1	2015-04-21 10:01:27 -07:00
video	fbdev changes for v4.1	2015-04-20 15:16:25 -07:00
xen	xenbus_client: Extend interface to support multi-page ring	2015-04-15 10:56:47 +01:00
Kbuild