Jakub Kicinski 7b245fbd23 net: don't clear sock->sk early to avoid trouble in strparser ... [ Upstream commit 2b81f8161d ] af_inet sets sock->sk to NULL which trips strparser over: BUG: kernel NULL pointer dereference, address: 0000000000000012 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.2.0-rc1-00139-g14629453a6d3 #21 RIP: 0010:tcp_peek_len+0x10/0x60 RSP: 0018:ffffc02e41c54b98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9cf924c4e030 RCX: 0000000000000051 RDX: 0000000000000000 RSI: 000000000000000c RDI: ffff9cf97128f480 RBP: ffff9cf9365e0300 R08: ffff9cf94fe7d2c0 R09: 0000000000000000 R10: 000000000000036b R11: ffff9cf939735e00 R12: ffff9cf91ad9ae40 R13: ffff9cf924c4e000 R14: ffff9cf9a8fcbaae R15: 0000000000000020 FS: 0000000000000000(0000) GS:ffff9cf9af7c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 000000013920a003 CR4: 00000000003606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> strp_data_ready+0x48/0x90 tls_data_ready+0x22/0xd0 [tls] tcp_rcv_established+0x569/0x620 tcp_v4_do_rcv+0x127/0x1e0 tcp_v4_rcv+0xad7/0xbf0 ip_protocol_deliver_rcu+0x2c/0x1c0 ip_local_deliver_finish+0x41/0x50 ip_local_deliver+0x6b/0xe0 ? ip_protocol_deliver_rcu+0x1c0/0x1c0 ip_rcv+0x52/0xd0 ? ip_rcv_finish_core.isra.20+0x380/0x380 __netif_receive_skb_one_core+0x7e/0x90 netif_receive_skb_internal+0x42/0xf0 napi_gro_receive+0xed/0x150 nfp_net_poll+0x7a2/0xd30 [nfp] ? kmem_cache_free_bulk+0x286/0x310 net_rx_action+0x149/0x3b0 __do_softirq+0xe3/0x30a ? handle_irq_event_percpu+0x6a/0x80 irq_exit+0xe8/0xf0 do_IRQ+0x85/0xd0 common_interrupt+0xf/0xf </IRQ> RIP: 0010:cpuidle_enter_state+0xbc/0x450 To avoid this issue set sock->sk after sk_prot->close. My grepping and testing did not discover any code which would depend on the current behaviour. Fixes: c46234ebb4 ("tls: RX path for ktls") Reported-by: David Beckett <david.beckett@netronome.com> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-01-27 14:50:52 +01:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	9p: Transport error uninitialized	2019-10-11 18:21:12 +02:00
802
8021q	vlan: vlan_changelink() should propagate errors	2020-01-12 12:17:28 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-13 08:52:59 +01:00
atm	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 13:09:32 +02:00
batman-adv	batman-adv: Fix DAT candidate selection on little endian systems	2020-01-23 08:21:34 +01:00
bluetooth	Bluetooth: Fix memory leak in hci_connect_le_scan	2020-01-09 10:19:04 +01:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule	2020-01-27 14:50:47 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: gw: Fix error path of cgw_module_init	2019-08-29 08:28:30 +02:00
ceph	libceph: fix PG split vs OSD (re)connect race	2019-08-29 08:28:50 +02:00
core	net: core: support XDP generic on stacked devices.	2020-01-27 14:50:52 +01:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	dccp: Fix memleak in __feat_register_sp	2020-01-17 19:46:58 +01:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:13:37 +01:00
dns_resolver	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
dsa	net: dsa: Avoid null pointer when failing to connect to PHY	2020-01-27 14:50:34 +01:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:19:09 +01:00
hsr	hsr: reset network header when supervision frame is created	2020-01-17 19:47:00 +01:00
ieee802154	inet: frags: call inet_frags_fini() after unregister_pernet_subsys()	2020-01-27 14:50:51 +01:00
ife
ipv4	net: don't clear sock->sk early to avoid trouble in strparser	2020-01-27 14:50:52 +01:00
ipv6	inet: frags: call inet_frags_fini() after unregister_pernet_subsys()	2020-01-27 14:50:51 +01:00
iucv	Revert "net: simplify sock_poll_wait"	2018-11-04 14:50:51 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: fix leaks in key_pol_get_resp and dump_sp.	2019-07-26 09:14:01 +02:00
l2tp	l2tp: Fix possible NULL pointer dereference	2020-01-27 14:50:46 +01:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)	2020-01-12 12:17:23 +01:00
mac80211	mac80211: Do not send Layer 2 Update frame before authorization	2020-01-17 19:46:56 +01:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	mpls: Return error for RTA_GATEWAY attribute	2019-03-10 07:17:19 +01:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	netfilter: nft_flow_offload: add entry to flowtable after confirmation	2020-01-27 14:50:43 +01:00
netlabel	netlabel: fix out-of-bounds memory accesses	2019-03-10 07:17:18 +01:00
netlink	genetlink: Fix a memory leak on error path	2019-04-03 06:26:15 +02:00
netrom	netrom: hold sock when setting skb->destructor	2019-07-28 08:29:27 +02:00
nfc	net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()	2019-12-31 16:34:38 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: support asymmetric conntrack	2019-12-21 10:57:14 +01:00
packet	packet: in recvmsg msg_name return at least sizeof sockaddr_ll	2020-01-27 14:50:43 +01:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 09:21:30 +01:00
qrtr	net: qrtr: fix memort leak in qrtr_tun_write_iter	2019-12-13 08:52:58 +01:00
rds	net/rds: Fix error handling in rds_ib_add_one()	2019-10-07 18:57:24 +02:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:17:17 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix detection of out of order acks	2020-01-27 14:50:38 +01:00
sched	net/sched: cbs: fix port_rate miscalculation	2020-01-27 14:50:37 +01:00
sctp	sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY	2020-01-12 12:17:27 +01:00
smc	net/smc: original socket family in inet_sock_diag	2020-01-27 14:50:20 +01:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	SUNRPC: Fix svcauth_gss_proxy_init()	2020-01-27 14:49:51 +01:00
switchdev
tipc	tipc: set sysctl_tipc_rmem and named_timeout right range	2020-01-27 14:50:39 +01:00
tls	net: tls, fix sk_write_space NULL write when tx disabled	2019-09-06 10:22:04 +02:00
unix	af_unix: add compat_ioctl support	2020-01-17 19:47:07 +01:00
vmw_vsock	VSOCK: bind to random port for VMADDR_PORT_ANY	2019-12-05 09:20:19 +01:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	cfg80211: regulatory: make initialization more robust	2020-01-27 14:49:57 +01:00
x25	net/x25: fix null_x25_address handling	2019-12-13 08:52:15 +01:00
xdp	xsk: add missing smp_rmb() in xsk_mmap	2020-01-27 14:50:21 +01:00
xfrm	xfrm interface: fix management of phydev	2019-12-13 08:52:42 +01:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile	bpfilter: check compiler capability in Kconfig	2018-06-28 13:36:39 +09:00
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-01-17 19:47:07 +01:00
sysctl_net.c