Florian Westphal 5e20087d1b mptcp: handle mptcp listener destruction via rcu ... Following splat can occur during self test: BUG: KASAN: use-after-free in subflow_data_ready+0x156/0x160 Read of size 8 at addr ffff888100c35c28 by task mptcp_connect/4808 subflow_data_ready+0x156/0x160 tcp_child_process+0x6a3/0xb30 tcp_v4_rcv+0x2231/0x3730 ip_protocol_deliver_rcu+0x5c/0x860 ip_local_deliver_finish+0x220/0x360 ip_local_deliver+0x1c8/0x4e0 ip_rcv_finish+0x1da/0x2f0 ip_rcv+0xd0/0x3c0 __netif_receive_skb_one_core+0xf5/0x160 __netif_receive_skb+0x27/0x1c0 process_backlog+0x21e/0x780 net_rx_action+0x35f/0xe90 do_softirq+0x4c/0x50 [..] This occurs when accessing subflow_ctx->conn. Problem is that tcp_child_process() calls listen sockets' sk_data_ready() notification, but it doesn't hold the listener lock. Another cpu calling close() on the listener will then cause transition of refcount to 0. Fixes: 58b0991962 ("mptcp: create msk early") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-04-20 12:59:32 -07:00
..
6lowpan
9p	9pnet: allow making incomplete read requests	2020-03-27 09:29:56 +00:00
802	net: 802: psnap.c: Use built-in RCU list checking	2020-02-24 13:02:53 -08:00
8021q	net: vlan: suppress "failed to kill vid" warnings	2020-02-17 14:30:54 -08:00
appletalk
atm	proc: convert everything to "struct proc_ops"	2020-02-04 03:05:26 +00:00
ax25
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
bluetooth	Bluetooth: L2CAP: Use DEFER_SETUP to group ECRED connections	2020-03-25 22:16:08 +01:00
bpf	bpf: Fix build warning regarding missing prototypes	2020-03-28 18:13:18 +01:00
bpfilter	SPDX patches for 5.7-rc1.	2020-04-03 13:12:26 -07:00
bridge	net: bridge: vlan options: move the tunnel command to the nested attribute	2020-03-20 08:52:20 -07:00
caif	net: caif: Add lockdep expression to RCU traversal primitive	2020-03-11 22:55:25 -07:00
can
ceph	libceph: directly skip to the end of redirect reply	2020-03-30 12:42:41 +02:00
core	xdp: Reset prog in dev_change_xdp_fd when fd is negative	2020-04-14 21:38:02 +02:00
dcb
dccp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-02-29 15:53:35 -08:00
decnet	Remove DST_HOST	2020-03-23 21:57:44 -07:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-03-29 12:40:41 +01:00
dsa	net: dsa: Down cpu/dsa ports phylink will control	2020-04-14 16:33:26 -07:00
ethernet	net: remove eth_change_mtu	2020-01-27 11:09:31 +01:00
ethtool	ethtool: provide timestamping information with TSINFO_GET request	2020-03-29 22:32:37 -07:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-07 18:34:18 -07:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-03 13:28:48 -08:00
ife
ipv4	net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin	2020-04-09 10:27:23 -07:00
ipv6	ipv6: fix restrict IPV6_ADDRFORM operation	2020-04-20 11:06:39 -07:00
iucv
kcm	net: kcm: kcmproc.c: Fix RCU list suspicious usage warning	2020-03-16 17:14:02 -07:00
key
l2tp	l2tp: Allow management of tunnels and session in user namespace	2020-04-08 14:30:46 -07:00
l3mdev
lapb
llc	af_llc: fix if-statement empty body warning	2020-02-26 20:38:13 -08:00
mac80211	mac80211: fix channel switch trigger from unknown mesh peer	2020-04-15 09:54:26 +02:00
mac802154
mpls	net: add net available in build_state	2020-03-29 22:30:57 -07:00
mptcp	mptcp: handle mptcp listener destruction via rcu	2020-04-20 12:59:32 -07:00
ncsi
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-04-16 14:52:29 -07:00
netlabel	netlabel_domainhash.c: Use built-in RCU list checking	2020-02-18 12:44:23 -08:00
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-25 18:58:11 -07:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-04-18 13:09:46 -07:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
nsh
openvswitch	net: openvswitch: ovs_ct_exit to be done under ovs_lock	2020-04-20 10:53:54 -07:00
packet	net/packet: tpacket_rcv: avoid a producer race condition	2020-03-15 00:25:25 -07:00
phonet
psample
qrtr	net: qrtr: send msgs from local of same id as broadcast	2020-04-09 10:08:31 -07:00
rds	net/rds: Use ERR_PTR for rds_message_alloc_sgs()	2020-04-15 12:33:29 -07:00
rfkill
rose	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-01-26 10:40:21 +01:00
rxrpc	rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket	2020-04-14 16:26:47 -07:00
sched	net: sched: Fix setting last executed chain on skb extension	2020-04-07 18:32:08 -07:00
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-30 20:48:43 -07:00
smc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-12 22:34:48 -07:00
strparser
sunrpc	NFS client updates for Linux 5.7	2020-04-07 13:51:39 -07:00
switchdev	net: switchdev: do not propagate bridge updates across bridges	2020-02-26 20:58:33 -08:00
tipc	tipc: Fix potential tipc_node refcnt leak in tipc_rcv	2020-04-18 13:24:20 -07:00
tls	net/tls: fix const assignment warning	2020-04-08 14:34:02 -07:00
unix	net: datagram: drop 'destructor' argument from several helpers	2020-02-28 12:12:53 -08:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-02-27 18:31:39 -08:00
wimax
wireless	nl80211: fix NL80211_ATTR_FTM_RESPONDER policy	2020-04-14 12:28:48 +02:00
x25	net: x25: convert to list_for_each_entry_safe()	2020-02-16 18:59:42 -08:00
xdp	xsk: Add missing check on user supplied headroom size	2020-04-15 13:07:18 +02:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2020-03-30 10:59:20 -07:00
compat.c	net: abstract out normal and compat msghdr import	2020-03-10 09:12:49 -06:00
Kconfig	net: Fix CONFIG_NET_CLS_ACT=n and CONFIG_NFT_FWD_NETDEV={y, m} build	2020-03-25 12:24:33 -07:00
Makefile	mptcp: Add MPTCP socket stubs	2020-01-24 13:44:07 +01:00
socket.c	for-5.7/io_uring-2020-03-29	2020-03-30 12:18:49 -07:00
sysctl_net.c