github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 21:15:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
986,515 Commits 1 Branch 933 Tags 20 GiB
C 97%
Assembly 1%
Shell 0.6%
Rust 0.5%
Python 0.4%
Other 0.3%
3535c632e6
Go to file
David Howells 3535c632e6 rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] 
[ Upstream commit 3bcd6c7eaa ]

After rxrpc_unbundle_conn() has removed a connection from a bundle, it
checks to see if there are any conns with available channels and, if not,
removes and attempts to destroy the bundle.

Whilst it does check after grabbing client_bundles_lock that there are no
connections attached, this races with rxrpc_look_up_bundle() retrieving the
bundle, but not attaching a connection for the connection to be attached
later.

There is therefore a window in which the bundle can get destroyed before we
manage to attach a new connection to it.

Fix this by adding an "active" counter to struct rxrpc_bundle:

 (1) rxrpc_connect_call() obtains an active count by prepping/looking up a
     bundle and ditches it before returning.

 (2) If, during rxrpc_connect_call(), a connection is added to the bundle,
     this obtains an active count, which is held until the connection is
     discarded.

 (3) rxrpc_deactivate_bundle() is created to drop an active count on a
     bundle and destroy it when the active count reaches 0.  The active
     count is checked inside client_bundles_lock() to prevent a race with
     rxrpc_look_up_bundle().

 (4) rxrpc_unbundle_conn() then calls rxrpc_deactivate_bundle().

Fixes: 245500d853 ("rxrpc: Rewrite the client connection manager")
Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-15975
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: zdi-disclosures@trendmicro.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-02 17:39:59 +01:00
arch ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl 2022-12-02 17:39:59 +01:00
block block, bfq: fix null pointer dereference in bfq_bio_bfqg() 2022-12-02 17:39:58 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:13:17 +02:00
crypto crypto: akcipher - default implementation for setting a private key 2022-10-26 13:25:42 +02:00
Documentation docs: update mediator contact information in CoC doc 2022-11-25 17:45:53 +01:00
drivers net: liquidio: simplify if expression 2022-12-02 17:39:59 +01:00
fs ceph: avoid putting the realm twice when decoding snaps fails 2022-12-02 17:39:57 +01:00
include rxrpc: Use refcount_t rather than atomic_t 2022-12-02 17:39:59 +01:00
init Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug 2022-06-09 10:21:25 +02:00
ipc ipc: remove memcg accounting for sops objects in do_semtimedop() 2022-11-10 18:14:29 +01:00
kernel kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case 2022-11-25 17:45:55 +01:00
lib dyndbg: drop EXPORTed dynamic_debug_exec_queries 2022-10-26 13:25:34 +02:00
LICENSES
mm mm: fs: initialize fsdata passed to write_begin/write_end interface 2022-11-25 17:45:56 +01:00
net rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] 2022-12-02 17:39:59 +01:00
samples x86: Prepare inline-asm for straight-line-speculation 2022-07-25 11:26:29 +02:00
scripts stddef: Introduce struct_group() helper macro 2022-11-25 17:45:54 +01:00
security capabilities: fix potential memleak on error path from vfs_getxattr_alloc() 2022-11-10 18:14:26 +01:00
sound ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open() 2022-12-02 17:39:59 +01:00
tools selftests/bpf: Add verifier test for release_reference() 2022-12-02 17:39:58 +01:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:25:48 +01:00
virt kvm: Add support for arch compat vm ioctls 2022-10-30 09:41:15 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: add Amir as xfs maintainer for 5.10.y 2022-07-02 16:39:22 +02:00
Makefile Linux 5.10.156 2022-11-25 17:45:57 +01:00
README

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.