summaryrefslogtreecommitdiffstats
path: root/net/rxrpc
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2019-08-12 23:30:06 +0100
committerDavid Howells <dhowells@redhat.com>2019-08-14 11:37:51 +0100
commitb00df840fb4004b7087940ac5f68801562d0d2de (patch)
treeb87b4b71c31483551e546dff3ebca8fc1c172dc2 /net/rxrpc
parent125b7e0949d4e72b15c2b1a1590f8cece985a918 (diff)
downloadlinux-b00df840fb4004b7087940ac5f68801562d0d2de.tar.bz2
rxrpc: Fix local endpoint replacement
When a local endpoint (struct rxrpc_local) ceases to be in use by any AF_RXRPC sockets, it starts the process of being destroyed, but this doesn't cause it to be removed from the namespace endpoint list immediately as tearing it down isn't trivial and can't be done in softirq context, so it gets deferred. If a new socket comes along that wants to bind to the same endpoint, a new rxrpc_local object will be allocated and rxrpc_lookup_local() will use list_replace() to substitute the new one for the old. Then, when the dying object gets to rxrpc_local_destroyer(), it is removed unconditionally from whatever list it is on by calling list_del_init(). However, list_replace() doesn't reset the pointers in the replaced list_head and so the list_del_init() will likely corrupt the local endpoints list. Fix this by using list_replace_init() instead. Fixes: 730c5fd42c1e ("rxrpc: Fix local endpoint refcounting") Reported-by: syzbot+193e29e9387ea5837f1d@syzkaller.appspotmail.com Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net/rxrpc')
-rw-r--r--net/rxrpc/local_object.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index c9db3e762d8d..c45765b7263e 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -283,7 +283,7 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
goto sock_error;
if (cursor != &rxnet->local_endpoints)
- list_replace(cursor, &local->link);
+ list_replace_init(cursor, &local->link);
else
list_add_tail(&local->link, cursor);
age = "new";