From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DD81CA9ED4 for ; Mon, 4 Nov 2019 22:12:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 11730214D8 for ; Mon, 4 Nov 2019 22:12:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572905567; bh=k9jy+lx+shuuvnVRszCf8uaiSUPr42VBGyRwNfbn6ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=r4rlqn0VA6vhxyaKCTfe0Y7QGdHKUJrKiq3t70+NlqL2C4VEFy0SmnT+T8ddrWc4k YOkE/YLnV9rsG/LQrDXaNYBja51VAyZakb+kMBl5trQ+v74HOiUSdQrgt1CLwdxyK/ ahLNezgwTiG2+9dPauxAY7y1rSyRk1kH8Z21orTI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388841AbfKDWMp (ORCPT ); Mon, 4 Nov 2019 17:12:45 -0500 Received: from mail.kernel.org ([198.145.29.99]:43958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390142AbfKDWKn (ORCPT ); Mon, 4 Nov 2019 17:10:43 -0500 Received: from localhost (6.204-14-84.ripe.coltfrance.com [84.14.204.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 87F8F205C9; Mon, 4 Nov 2019 22:10:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572905442; bh=k9jy+lx+shuuvnVRszCf8uaiSUPr42VBGyRwNfbn6ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NMiqffWCyelQNQ9SDa0IJ8+jbwFl3dqPGbXoXEfJUQ9oHAJrcZMnB65DHWg4g/TAF NKsHiFQQmL16H2+O9a9PMNZtvRIkbdgaCdmLmaBtIvcBn0FnJOZ3TWYmZi0cvH1n/C EFSHppZLImI9IkN9NS6LfQoPVVLYBIjVpvOf/eyI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com, David Howells Subject: [PATCH 5.3 148/163] rxrpc: Fix call ref leak Date: Mon, 4 Nov 2019 22:45:38 +0100 Message-Id: <20191104212151.036425778@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191104212140.046021995@linuxfoundation.org> References: <20191104212140.046021995@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: David Howells commit c48fc11b69e95007109206311b0187a3090591f3 upstream. When sendmsg() finds a call to continue on with, if the call is in an inappropriate state, it doesn't release the ref it just got on that call before returning an error. This causes the following symptom to show up with kasan: BUG: KASAN: use-after-free in rxrpc_send_keepalive+0x8a2/0x940 net/rxrpc/output.c:635 Read of size 8 at addr ffff888064219698 by task kworker/0:3/11077 where line 635 is: whdr.epoch = htonl(peer->local->rxnet->epoch); The local endpoint (which cannot be pinned by the call) has been released, but not the peer (which is pinned by the call). Fix this by releasing the call in the error path. Fixes: 37411cad633f ("rxrpc: Fix potential NULL-pointer exception") Reported-by: syzbot+d850c266e3df14da1d31@syzkaller.appspotmail.com Signed-off-by: David Howells Signed-off-by: Greg Kroah-Hartman --- net/rxrpc/sendmsg.c | 1 + 1 file changed, 1 insertion(+) --- a/net/rxrpc/sendmsg.c +++ b/net/rxrpc/sendmsg.c @@ -661,6 +661,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock * case RXRPC_CALL_SERVER_PREALLOC: case RXRPC_CALL_SERVER_SECURING: case RXRPC_CALL_SERVER_ACCEPTING: + rxrpc_put_call(call, rxrpc_call_put); ret = -EBUSY; goto error_release_sock; default: