xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rxrpc: Fix missing active use pinning of rxrpc_local object

Browse Source 
The introduction of a split between the reference count on rxrpc_local
objects and the usage count didn't quite go far enough.  A number of kernel
work items need to make use of the socket to perform transmission.  These
also need to get an active count on the local object to prevent the socket
from being closed.

Fix this by getting the active count in those places.

Also split out the raw active count get/put functions as these places tend
to hold refs on the rxrpc_local object already, so getting and putting an
extra object ref is just a waste of time.

The problem can lead to symptoms like:

    BUG: kernel NULL pointer dereference, address: 0000000000000018
    ..
    CPU: 2 PID: 818 Comm: kworker/u9:0 Not tainted 5.5.0-fscache+ #51
    ...
    RIP: 0010:selinux_socket_sendmsg+0x5/0x13
    ...
    Call Trace:
     security_socket_sendmsg+0x2c/0x3e
     sock_sendmsg+0x1a/0x46
     rxrpc_send_keepalive+0x131/0x1ae
     rxrpc_peer_keepalive_worker+0x219/0x34b
     process_one_work+0x18e/0x271
     worker_thread+0x1a3/0x247
     kthread+0xe6/0xeb
     ret_from_fork+0x1f/0x30

Fixes: 730c5fd42c ("rxrpc: Fix local endpoint refcounting")
Signed-off-by: David Howells <dhowells@redhat.com>
This commit is contained in:
David Howells
2020-01-30 21:50:36 +00:00
parent f71dbf2fb2
commit 04d36d748f
5 changed files with 61 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
net/rxrpc/local_object.c
View File

@@ -383,14 +383,11 @@ void rxrpc_put_local(struct rxrpc_local *local)
*/
struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
{
unsigned int au;
local = rxrpc_get_local_maybe(local);
if (!local)
return NULL;
au = atomic_fetch_add_unless(&local->active_users, 1, 0);
if (au == 0) {
if (!__rxrpc_use_local(local)) {
rxrpc_put_local(local);
return NULL;
}
@@ -404,14 +401,11 @@ struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
*/
void rxrpc_unuse_local(struct rxrpc_local *local)
{
unsigned int au;
if (local) {
au = atomic_dec_return(&local->active_users);
if (au == 0)
if (__rxrpc_unuse_local(local)) {
rxrpc_get_local(local);
rxrpc_queue_local(local);
else
rxrpc_put_local(local);
}
}
}
@@ -468,7 +462,7 @@ static void rxrpc_local_processor(struct work_struct *work)
do {
again = false;
if (atomic_read(&local->active_users) == 0) {
if (!__rxrpc_use_local(local)) {
rxrpc_local_destroyer(local);
break;
}
@@ -482,6 +476,8 @@ static void rxrpc_local_processor(struct work_struct *work)
rxrpc_process_local_events(local);
again = true;
}
__rxrpc_unuse_local(local);
} while (again);
rxrpc_put_local(local);