Magnus Karlsson 85c2c79a07 xsk: fix refcount underflow in error path ... Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can only fail due to not having enough memory, then the error path is triggered. In this error path, the refcount of the pool is decremented as it has incremented before. However, the reference to the pool in the socket was not nulled. This means that when the socket is closed later, the socket teardown logic will think that there is a pool attached to the socket and try to decrease the refcount again, leading to a refcount underflow. I chose this fix as it involved adding just a single line. Another option would have been to move xp_get_pool() and the assignment of xs->pool to after the if-statement and using xs_umem->pool instead of xs->pool in the whole if-statement resulting in somewhat simpler code, but this would have led to much more churn in the code base perhaps making it harder to backport. Fixes: ba3beec2ec ("xsk: Fix possible crash when multiple sockets are created") Reported-by: syzbot+8ada0057e69293a05fd4@syzkaller.appspotmail.com Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com> Link: https://lore.kernel.org/r/20230809142843.13944-1-magnus.karlsson@gmail.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>		2023-08-09 20:08:04 -07:00
..
6lowpan	6lowpan: Remove redundant initialisation.	2023-03-29 08:22:52 +01:00
9p	9p: remove dead stores (variable set again without being read)	2023-07-20 19:14:50 +00:00
802
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-17 12:55:39 +01:00
appletalk	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
atm	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
ax25	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
batman-adv	batman-adv: Broken sync while rescheduling delayed work	2023-05-26 23:14:49 +02:00
bluetooth	Bluetooth: MGMT: Use correct address for memcpy()	2023-07-20 11:27:22 -07:00
bpf	bpf: Move kernel test kfuncs to bpf_testmod	2023-05-16 22:09:24 -07:00
bpfilter	net: Use umd_cleanup_helper()	2023-05-31 13:06:57 +02:00
bridge	Revert "bridge: Add extack warning when enabling STP in netns."	2023-07-20 10:46:28 +02:00
caif	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
can	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
ceph	rbd: harden get_lock_owner_info() a bit	2023-07-26 15:08:09 +02:00
core	pull-request: bpf 2023-08-03	2023-08-03 11:22:53 -07:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-01 21:07:46 -07:00
dccp	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
devlink	devlink: report devlink_port_type_warn source device	2023-06-17 00:31:14 -07:00
dns_resolver
dsa	net: dsa: fix older DSA drivers using phylink	2023-07-27 17:19:46 -07:00
ethernet
ethtool	net: create device lookup API with reference tracking	2023-06-15 08:21:11 +01:00
handshake	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-15 22:19:41 -07:00
hsr	net: hsr: Disable promiscuous mode in offload mode	2023-06-21 16:47:05 -07:00
ieee802154	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
ife
ipv4	tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen	2023-08-03 10:58:24 -07:00
ipv6	ip6mr: Fix skb_under_panic in ip6mr_cache_report()	2023-08-02 10:35:21 +01:00
iucv	net/iucv: Fix size of interrupt data	2023-03-16 17:34:40 -07:00
kcm	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
key	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
l2tp	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
l3mdev
lapb
llc	llc: Don't drop packet from non-root netns.	2023-07-20 10:46:28 +02:00
mac80211	- New Drivers	2023-07-03 11:26:05 -07:00
mac802154	Core WPAN changes:	2023-06-24 15:41:46 -07:00
mctp	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
mpls	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
mptcp	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
ncsi	net/ncsi: change from ndo_set_mac_address to dev_set_mac_address	2023-06-09 10:32:51 +01:00
netfilter	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
netlabel	netlabel: Reorder fields in 'struct netlbl_domaddr6_map'	2023-06-20 20:06:56 -07:00
netlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
netrom	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2023-06-27 09:45:22 -07:00
nsh	net: move gso declarations and functions to their own files	2023-06-10 00:11:41 -07:00
openvswitch	net: openvswitch: add support for l4 symmetric hashing	2023-06-12 09:46:30 +01:00
packet	net: annotate data-races around sk->sk_priority	2023-07-29 18:13:41 +01:00
phonet	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
psample
qrtr	Networking changes for 6.5.	2023-06-28 16:43:10 -07:00
rds	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
rfkill	net: rfkill-gpio: Add explicit include for of.h	2023-04-06 20:36:27 +02:00
rose	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
rxrpc	Networking changes for 6.5.	2023-06-28 16:43:10 -07:00
sched	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free	2023-07-31 20:10:37 -07:00
sctp	sctp: fix potential deadlock on &net->sctp.addr_wq_lock	2023-06-29 11:49:42 +02:00
smc	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
strparser
sunrpc	NFS client updates for Linux 6.5	2023-07-01 14:38:25 -07:00
switchdev
tipc	tipc: stop tipc crypto on failure in tipc_node_create	2023-07-27 11:45:05 +02:00
tls	net: Kill MSG_SENDPAGE_NOTLAST	2023-06-24 15:50:13 -07:00
unix	net: add missing data-race annotations around sk->sk_peek_off	2023-07-29 18:13:41 +01:00
vmw_vsock	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
wireless	wifi: cfg80211: Fix return value in scan logic	2023-07-26 10:08:07 +03:00
x25	sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES)	2023-06-24 15:50:13 -07:00
xdp	xsk: fix refcount underflow in error path	2023-08-09 20:08:04 -07:00
xfrm	net: annotate data-races around sk->sk_mark	2023-07-29 18:13:41 +01:00
compat.c	net/compat: Update msg_control_is_user when setting a kernel pointer	2023-04-14 11:09:27 +01:00
devres.c
Kconfig	net/core: Enable socket busy polling on -RT	2023-05-26 08:51:26 +01:00
Kconfig.debug
Makefile	net/handshake: Create a NETLINK service for handling handshake requests	2023-04-19 18:48:48 -07:00
socket.c	Networking changes for 6.5.	2023-06-28 16:43:10 -07:00
sysctl_net.c