David Howells 8cbf4ae7a2 rxrpc: Fix call timer start racing with call destruction ... commit 4a7f62f919 upstream. The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the same time a packet comes in addressed to that call. This causes the timer - which was already stopped - to get restarted. Later, the timer dispatch code may then oops if the timer got deallocated first. Fix this by trying to take a ref on the rxrpc_call struct and, if successful, passing that ref along to the timer. If the timer was already running, the ref is discarded. The timer completion routine can then pass the ref along to the call's work item when it queues it. If the timer or work item where already queued/running, the extra ref is discarded. Fixes: a158bdd324 ("rxrpc: Fix call timeouts") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> Tested-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2022-March/005073.html Link: https://lore.kernel.org/r/164865115696.2943015.11097991776647323586.stgit@warthog.procyon.org.uk Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-08 14:24:10 +02:00
..
acpi
asm-generic
clocksource
crypto
drm	drm/dp: Fix off-by-one in register cache size	2022-04-08 14:24:04 +02:00
dt-bindings
keys
kunit
kvm
linux	nvme: allow duplicate NSIDs for private namespaces	2022-04-08 14:24:09 +02:00
math-emu
media
memory
misc
net	netfilter: conntrack: Add and use nf_ct_set_auto_assign_helper_warned()	2022-04-08 14:23:42 +02:00
pcmcia
ras
rdma
scsi	scsi: core: sd: Add silence_suspend flag to suppress some PM messages	2022-04-08 14:22:54 +02:00
soc
sound	ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock	2022-04-08 14:22:55 +02:00
target
trace	rxrpc: Fix call timer start racing with call destruction	2022-04-08 14:24:10 +02:00
uapi	serial: 8250_aspeed_vuart: add PORT_ASPEED_VUART port type	2022-04-08 14:23:45 +02:00
vdso
video
xen