Eric Dumazet 7749d4ff88 dccp: purge write queue in dccp_destroy_sock() ... syzkaller reported that DCCP could have a non empty write queue at dismantle time. WARNING: CPU: 1 PID: 2953 at net/core/stream.c:199 sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 2953 Comm: syz-executor0 Not tainted 4.13.0-rc4+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 panic+0x1e4/0x417 kernel/panic.c:180 __warn+0x1c4/0x1d9 kernel/panic.c:541 report_bug+0x211/0x2d0 lib/bug.c:183 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190 do_trap_no_signal arch/x86/kernel/traps.c:224 [inline] do_trap+0x260/0x390 arch/x86/kernel/traps.c:273 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:310 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323 invalid_op+0x1e/0x30 arch/x86/entry/entry_64.S:846 RIP: 0010:sk_stream_kill_queues+0x3ce/0x520 net/core/stream.c:199 RSP: 0018:ffff8801d182f108 EFLAGS: 00010297 RAX: ffff8801d1144140 RBX: ffff8801d13cb280 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff85137b00 RDI: ffff8801d13cb280 RBP: ffff8801d182f148 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801d13cb4d0 R13: ffff8801d13cb3b8 R14: ffff8801d13cb300 R15: ffff8801d13cb3b8 inet_csk_destroy_sock+0x175/0x3f0 net/ipv4/inet_connection_sock.c:835 dccp_close+0x84d/0xc10 net/dccp/proto.c:1067 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425 sock_release+0x8d/0x1e0 net/socket.c:597 sock_close+0x16/0x20 net/socket.c:1126 __fput+0x327/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:246 task_work_run+0x18a/0x260 kernel/task_work.c:116 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0xa32/0x1b10 kernel/exit.c:865 do_group_exit+0x149/0x400 kernel/exit.c:969 get_signal+0x7e8/0x17e0 kernel/signal.c:2330 do_signal+0x94/0x1ee0 arch/x86/kernel/signal.c:808 exit_to_usermode_loop+0x21c/0x2d0 arch/x86/entry/common.c:157 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath+0x3a7/0x450 arch/x86/entry/common.c:263 Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-08-14 22:28:18 -07:00
..
ccids	dccp: do not use tcp_time_stamp	2017-05-17 16:06:01 -04:00
ackvec.c	dccp: drop null test before destroy functions	2015-09-15 16:49:43 -07:00
ackvec.h
ccid.c	dccp: drop null test before destroy functions	2015-09-15 16:49:43 -07:00
ccid.h
dccp.h	net: snmp: kill STATS_BH macros	2016-04-27 22:48:25 -04:00
diag.c	sock_diag: specify info_size per inet protocol	2015-06-15 19:49:22 -07:00
feat.c	dccp: fix a memleak for dccp_feat_init err process	2017-07-27 00:01:05 -07:00
feat.h
input.c	dccp: make const array error_code static	2017-07-13 09:24:02 -07:00
ipv4.c	dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly	2017-07-27 00:01:05 -07:00
ipv6.c	dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly	2017-07-27 00:01:05 -07:00
ipv6.h
Kconfig
Makefile
minisocks.c	dccp: fix use-after-free in dccp_feat_activate_values	2017-03-07 14:15:27 -08:00
options.c	networking: make skb_push & __skb_push return void pointers	2017-06-16 11:48:40 -04:00
output.c	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
probe.c	Use 64-bit timekeeping	2015-11-01 17:01:16 -05:00
proto.c	dccp: purge write queue in dccp_destroy_sock()	2017-08-14 22:28:18 -07:00
qpolicy.c
sysctl.c	dccp: make the request_retries minimum is 1	2014-05-14 15:34:16 -04:00
timer.c	net: rename NET_{ADD|INC}_STATS_BH()	2016-04-27 22:48:24 -04:00