Vlad Yasevich
50b5d6ad63
sctp: Fix a race between ICMP protocol unreachable and connect() ...
ICMP protocol unreachable handling completely disregarded
the fact that the user may have locked the socket. It proceeded
to destroy the association, even though the user may have
held the lock and had a ref on the association. This resulted
in the following:
Attempt to release alive inet socket f6afcc00
=========================
[ BUG: held lock freed! ]
-------------------------
somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held
there!
(sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c
1 lock held by somenu/2672:
#0 : (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c
stack backtrace:
Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55
Call Trace:
[<c1232266>] ? printk+0xf/0x11
[<c1038553>] debug_check_no_locks_freed+0xce/0xff
[<c10620b4>] kmem_cache_free+0x21/0x66
[<c1185f25>] __sk_free+0x9d/0xab
[<c1185f9c>] sk_free+0x1c/0x1e
[<c1216e38>] sctp_association_put+0x32/0x89
[<c1220865>] __sctp_connect+0x36d/0x3f4
[<c122098a>] ? sctp_connect+0x13/0x4c
[<c102d073>] ? autoremove_wake_function+0x0/0x33
[<c12209a8>] sctp_connect+0x31/0x4c
[<c11d1e80>] inet_dgram_connect+0x4b/0x55
[<c11834fa>] sys_connect+0x54/0x71
[<c103a3a2>] ? lock_release_non_nested+0x88/0x239
[<c1054026>] ? might_fault+0x42/0x7c
[<c1054026>] ? might_fault+0x42/0x7c
[<c11847ab>] sys_socketcall+0x6d/0x178
[<c10da994>] ? trace_hardirqs_on_thunk+0xc/0x10
[<c1002959>] syscall_call+0x7/0xb
This was because the sctp_wait_for_connect() would aqcure the socket
lock and then proceed to release the last reference count on the
association, thus cause the fully destruction path to finish freeing
the socket.
The simplest solution is to start a very short timer in case the socket
is owned by user. When the timer expires, we can do some verification
and be able to do the release properly.
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-05-06 00:56:07 -07:00
9p: Make sure we are able to clunk the cached fid on umount
2010-04-05 10:37:36 -05:00
Bluetooth: Convert debug files to actually use debugfs instead of sysfs
2010-03-21 05:49:35 +01:00
tree-wide: fix typos "ass?o[sc]iac?te" -> "associate" in comments
2010-02-15 15:38:10 +01:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
packet: convert socket list to RCU (v3)
2010-02-22 15:45:56 -08:00
Phonet: zero-copy GPRS TX
2010-01-07 00:24:55 -08:00
sctp: Fix a race between ICMP protocol unreachable and connect()
2010-05-06 00:56:07 -07:00
pkt_sched: skbedit add support for setting mark
2009-10-22 21:56:42 -07:00
net: restore gnet_stats_basic to previous definition
2009-08-17 21:33:49 -07:00
net: Add checking to rcu_dereference() primitives
2010-02-25 09:41:03 +01:00
af_ieee802154: add support for WANT_ACK socket option
2009-08-12 21:54:50 -07:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
net: make neigh_ops constant
2009-09-01 17:40:57 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
nl80211: add power save commands
2010-02-19 15:52:40 -05:00
net: fix compat_sys_recvmmsg parameter type
2009-12-11 15:07:56 -08:00
dcbnl: Add support for setapp/getapp to netdev dcbnl_rtnl_ops
2009-09-01 01:24:30 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6
2009-12-08 07:55:01 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
net: Add rtnetlink init_rcvwnd to set the TCP initial receive window
2009-12-23 14:13:30 -08:00
netns: embed ip6_dst_ops directly
2009-09-01 17:40:31 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
icmp: move icmp_err_convert[] to .rodata
2010-01-23 01:21:28 -08:00
wireless: update radiotap parser
2010-02-08 16:50:53 -05:00
ieee802154: add an mlme_ops call to retrieve PHY object
2009-11-06 14:32:18 +03:00
IPv6: convert mc_lock to spinlock
2010-02-17 18:48:44 -08:00
tcp: Fix a connect() race with timewait sockets
2009-12-08 20:17:51 -08:00
net: Make setsockopt() optlen be unsigned.
2009-09-30 16:12:20 -07:00
tcp: Fix a connect() race with timewait sockets
2009-12-08 20:17:51 -08:00
tcp: Generalized TTL Security Mechanism
2010-01-11 16:28:01 -08:00
tcp: Fix a connect() race with timewait sockets
2009-12-08 20:17:51 -08:00
inetpeer: Optimize inet_getid()
2009-11-13 20:46:58 -08:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
ipv6: use standard lists for FIB walks
2010-02-18 14:30:17 -08:00
ipv6: Optmize translation between IPV6_PREFER_SRC_xxx and RT6_LOOKUP_F_xxx.
2010-03-07 15:25:53 -08:00
ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.
2010-03-10 07:32:29 -08:00
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
2009-11-06 00:55:55 -08:00
ipvs: SCTP Trasport Loadbalancing Support
2010-02-18 12:31:05 +01:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
ipv6: Remove IPV6_ADDR_RESERVED
2010-02-26 03:59:07 -08:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
llc: convert llc_sap_list to RCU
2009-12-26 20:46:28 -08:00
llc: use a device based hash table to speed up multicast delivery
2009-12-26 20:43:57 -08:00
mac80211: Fix HT rate control configuration
2010-03-03 15:39:21 -05:00
sysctl: remove "struct file *" argument of ->proc_handler
2009-09-24 07:21:04 -07:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
nsproxy: remove INIT_NSPROXY()
2010-03-12 15:52:40 -08:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
netlink: fix unaligned access in nla_get_be64()
2010-03-19 22:47:23 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
ieee802154: add support for channel pages from IEEE 802.15.4-2006
2009-08-19 23:08:22 +04:00
net: rename skb->iif to skb->skb_iif
2009-11-20 15:35:04 -08:00
sched: add head drop fifo queue
2010-01-28 21:27:00 -08:00
net: drop capability from protocol definitions
2009-11-05 21:40:17 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
cfg80211: add regulatory hint disconnect support
2010-02-01 15:40:06 -05:00
tcp: account SYN-ACK timeouts & retransmissions
2010-01-17 19:09:39 -08:00
NET: ROSE: Don't use static buffer.
2009-07-26 19:11:14 -07:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
rtnetlink: support specifying device flags on device creation
2010-02-27 02:43:40 -08:00
sched: add head drop fifo queue
2010-01-28 21:27:00 -08:00
net: cleanup include/net
2009-11-04 05:06:25 -08:00
percpu: add __percpu sparse annotations to net
2010-02-16 23:05:38 -08:00
net: fix compile error due to double return type in SOCK_DEBUG
2010-05-02 13:42:39 -07:00
net: add scheduler sync hint to tcp_prequeue().
2010-03-04 00:53:51 -08:00
inet: inet_connection_sock_af_ops const
2009-09-02 01:03:49 -07:00
udp: bind() optimisation
2009-11-10 20:54:38 -08:00
wext: refactor
2009-10-07 16:39:43 -04:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2009-12-09 19:43:33 -08:00
ieee802154: add support for creation/removal of logic interfaces
2009-11-06 14:32:24 +03:00
Merge branch 'master' of /home/davem/src/GIT/linux-2.6/
2010-04-11 02:44:30 -07:00
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
2010-03-30 22:02:32 +09:00
50b5d6ad63