David Howells 051360e513 rxrpc: Fix call timer start racing with call destruction ... commit 4a7f62f919 upstream. The rxrpc_call struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq mode with just the RCU read lock held. Unfortunately, because only the RCU read lock is held - and neither ref or other lock is taken - the call can start getting destroyed at the same time a packet comes in addressed to that call. This causes the timer - which was already stopped - to get restarted. Later, the timer dispatch code may then oops if the timer got deallocated first. Fix this by trying to take a ref on the rxrpc_call struct and, if successful, passing that ref along to the timer. If the timer was already running, the ref is discarded. The timer completion routine can then pass the ref along to the call's work item when it queues it. If the timer or work item where already queued/running, the extra ref is discarded. Fixes: a158bdd324 ("rxrpc: Fix call timeouts") Reported-by: Marc Dionne <marc.dionne@auristor.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Marc Dionne <marc.dionne@auristor.com> Tested-by: Marc Dionne <marc.dionne@auristor.com> cc: linux-afs@lists.infradead.org Link: http://lists.infradead.org/pipermail/linux-afs/2022-March/005073.html Link: https://lore.kernel.org/r/164865115696.2943015.11097991776647323586.stgit@warthog.procyon.org.uk Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-04-08 14:40:41 +02:00
..
af_rxrpc.c	rxrpc: Fix deadlock around release of dst cached on udp tunnel	2021-02-10 09:29:13 +01:00
ar-internal.h	rxrpc: Fix call timer start racing with call destruction	2022-04-08 14:40:41 +02:00
call_accept.c	rxrpc: Fix memory leak in rxrpc_lookup_local	2021-02-03 23:28:50 +01:00
call_event.c	rxrpc: Fix call timer start racing with call destruction	2022-04-08 14:40:41 +02:00
call_object.c	rxrpc: Fix call timer start racing with call destruction	2022-04-08 14:40:41 +02:00
conn_client.c	rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()	2021-12-08 09:03:25 +01:00
conn_event.c	rxrpc: Fix loss of final ack on shutdown	2020-10-15 13:28:00 +01:00
conn_object.c
conn_service.c
input.c	rxrpc: Call state should be read with READ_ONCE() under some circumstances	2021-01-23 16:04:01 +01:00
insecure.c
Kconfig
key.c	rxrpc: Fix handling of an unsupported token type in rxrpc_read()	2021-01-23 16:04:03 +01:00
local_event.c
local_object.c
Makefile
misc.c
net_ns.c
output.c	rxrpc: Adjust retransmission backoff	2022-02-01 17:25:46 +01:00
peer_event.c
peer_object.c	rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()	2021-12-08 09:03:25 +01:00
proc.c
protocol.h
recvmsg.c
rtt.c	rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()	2021-11-18 14:04:03 +01:00
rxkad.c
security.c
sendmsg.c
skbuff.c
sysctl.c
utils.c