Vlad Yasevich 50b5d6ad63 sctp: Fix a race between ICMP protocol unreachable and connect() ... ICMP protocol unreachable handling completely disregarded the fact that the user may have locked the socket. It proceeded to destroy the association, even though the user may have held the lock and had a ref on the association. This resulted in the following: Attempt to release alive inet socket f6afcc00 ========================= [ BUG: held lock freed! ] ------------------------- somenu/2672 is freeing memory f6afcc00-f6afcfff, with a lock still held there! (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c 1 lock held by somenu/2672: #0: (sk_lock-AF_INET){+.+.+.}, at: [<c122098a>] sctp_connect+0x13/0x4c stack backtrace: Pid: 2672, comm: somenu Not tainted 2.6.32-telco #55 Call Trace: [<c1232266>] ? printk+0xf/0x11 [<c1038553>] debug_check_no_locks_freed+0xce/0xff [<c10620b4>] kmem_cache_free+0x21/0x66 [<c1185f25>] __sk_free+0x9d/0xab [<c1185f9c>] sk_free+0x1c/0x1e [<c1216e38>] sctp_association_put+0x32/0x89 [<c1220865>] __sctp_connect+0x36d/0x3f4 [<c122098a>] ? sctp_connect+0x13/0x4c [<c102d073>] ? autoremove_wake_function+0x0/0x33 [<c12209a8>] sctp_connect+0x31/0x4c [<c11d1e80>] inet_dgram_connect+0x4b/0x55 [<c11834fa>] sys_connect+0x54/0x71 [<c103a3a2>] ? lock_release_non_nested+0x88/0x239 [<c1054026>] ? might_fault+0x42/0x7c [<c1054026>] ? might_fault+0x42/0x7c [<c11847ab>] sys_socketcall+0x6d/0x178 [<c10da994>] ? trace_hardirqs_on_thunk+0xc/0x10 [<c1002959>] syscall_call+0x7/0xb This was because the sctp_wait_for_connect() would aqcure the socket lock and then proceed to release the last reference count on the association, thus cause the fully destruction path to finish freeing the socket. The simplest solution is to start a very short timer in case the socket is owned by user. When the timer expires, we can do some verification and be able to do the release properly. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2010-05-06 00:56:07 -07:00
..
9p	9p: Make sure we are able to clunk the cached fid on umount	2010-04-05 10:37:36 -05:00
bluetooth	Bluetooth: Convert debug files to actually use debugfs instead of sysfs	2010-03-21 05:49:35 +01:00
irda	tree-wide: fix typos "ass?o[sc]iac?te" -> "associate" in comments	2010-02-15 15:38:10 +01:00
iucv	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
netfilter	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
netns	packet: convert socket list to RCU (v3)	2010-02-22 15:45:56 -08:00
phonet	Phonet: zero-copy GPRS TX	2010-01-07 00:24:55 -08:00
sctp	sctp: Fix a race between ICMP protocol unreachable and connect()	2010-05-06 00:56:07 -07:00
tc_act	pkt_sched: skbedit add support for setting mark	2009-10-22 21:56:42 -07:00
tipc	tipc: Remove unneeded parameter to tipc_createport_raw()	2008-07-14 22:42:19 -07:00
act_api.h	net: restore gnet_stats_basic to previous definition	2009-08-17 21:33:49 -07:00
addrconf.h	net: Add checking to rcu_dereference() primitives	2010-02-25 09:41:03 +01:00
af_ieee802154.h	af_ieee802154: add support for WANT_ACK socket option	2009-08-12 21:54:50 -07:00
af_rxrpc.h	…
af_unix.h	net: Fix soft lockups/OOM issues w/ unix garbage collector	2008-11-26 15:32:27 -08:00
ah.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
arp.h	net: make neigh_ops constant	2009-09-01 17:40:57 -07:00
atmclip.h	clip: convert to internal network_device_stats	2009-01-21 14:01:59 -08:00
ax25.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
ax88796.h	ax88796: Add method to take MAC from platform data	2009-03-24 23:32:03 -07:00
cfg80211.h	nl80211: add power save commands	2010-02-19 15:52:40 -05:00
checksum.h	include/net net/ - csum_partial - remove unnecessary casts	2008-11-19 15:44:53 -08:00
cipso_ipv4.h	netlabel: Label incoming TCP connections correctly in SELinux	2009-03-28 15:01:36 +11:00
compat.h	net: fix compat_sys_recvmmsg parameter type	2009-12-11 15:07:56 -08:00
datalink.h	…
dcbnl.h	dcbnl: Add support for setapp/getapp to netdev dcbnl_rtnl_ops	2009-09-01 01:24:30 -07:00
dn.h	decnet: compile fix for removal of byteorder wrapper	2008-11-27 23:04:13 -08:00
dn_dev.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2009-12-08 07:55:01 -08:00
dn_fib.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
dn_neigh.h	…
dn_nsp.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
dn_route.h	…
dsa.h	dsa: add switch chip cascading support	2009-03-21 19:06:54 -07:00
dsfield.h	…
dst.h	net: Add rtnetlink init_rcvwnd to set the TCP initial receive window	2009-12-23 14:13:30 -08:00
dst_ops.h	netns: embed ip6_dst_ops directly	2009-09-01 17:40:31 -07:00
esp.h	…
ethoc.h	net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.	2009-03-27 00:16:21 -07:00
fib_rules.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
flow.h	netns xfrm: lookup in netns	2008-11-25 17:35:18 -08:00
garp.h	vlan: Add GVRP support	2008-07-05 21:26:57 -07:00
gen_stats.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
genetlink.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
icmp.h	icmp: move icmp_err_convert[] to .rodata	2010-01-23 01:21:28 -08:00
ieee80211_radiotap.h	wireless: update radiotap parser	2010-02-08 16:50:53 -05:00
ieee802154.h	ieee802154: move headers out of extra directory	2009-07-23 17:08:51 +04:00
ieee802154_netdev.h	ieee802154: add an mlme_ops call to retrieve PHY object	2009-11-06 14:32:18 +03:00
if_inet6.h	IPv6: convert mc_lock to spinlock	2010-02-17 18:48:44 -08:00
inet6_connection_sock.h	…
inet6_hashtables.h	tcp: Fix a connect() race with timewait sockets	2009-12-08 20:17:51 -08:00
inet_common.h	…
inet_connection_sock.h	net: Make setsockopt() optlen be unsigned.	2009-09-30 16:12:20 -07:00
inet_ecn.h	net: replace __constant_{endian} uses in net headers	2009-02-14 22:58:35 -08:00
inet_frag.h	inet fragments: fix sparse warning: context imbalance	2009-02-26 23:13:35 -08:00
inet_hashtables.h	tcp: Fix a connect() race with timewait sockets	2009-12-08 20:17:51 -08:00
inet_sock.h	tcp: Generalized TTL Security Mechanism	2010-01-11 16:28:01 -08:00
inet_timewait_sock.h	tcp: Fix a connect() race with timewait sockets	2009-12-08 20:17:51 -08:00
inetpeer.h	inetpeer: Optimize inet_getid()	2009-11-13 20:46:58 -08:00
ip.h	percpu: add __percpu sparse annotations to net	2010-02-16 23:05:38 -08:00
ip6_checksum.h	…
ip6_fib.h	ipv6: use standard lists for FIB walks	2010-02-18 14:30:17 -08:00
ip6_route.h	ipv6: Optmize translation between IPV6_PREFER_SRC_xxx and RT6_LOOKUP_F_xxx.	2010-03-07 15:25:53 -08:00
ip6_tunnel.h	ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.	2010-03-10 07:32:29 -08:00
ip_fib.h	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2009-11-06 00:55:55 -08:00
ip_vs.h	ipvs: SCTP Trasport Loadbalancing Support	2010-02-18 12:31:05 +01:00
ipcomp.h	percpu: add __percpu sparse annotations to net	2010-02-16 23:05:38 -08:00
ipconfig.h	net: remove CVS keywords	2008-06-11 21:00:38 -07:00
ipip.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
ipv6.h	ipv6: Remove IPV6_ADDR_RESERVED	2010-02-26 03:59:07 -08:00
ipx.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
iw_handler.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
lapb.h	…
lib80211.h	wireless: missing include in lib80211.h	2008-11-21 11:42:55 -05:00
llc.h	llc: convert llc_sap_list to RCU	2009-12-26 20:46:28 -08:00
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	llc: use a device based hash table to speed up multicast delivery	2009-12-26 20:43:57 -08:00
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
mac80211.h	mac80211: Fix HT rate control configuration	2010-03-03 15:39:21 -05:00
mip6.h	…
ndisc.h	sysctl: remove "struct file *" argument of ->proc_handler	2009-09-24 07:21:04 -07:00
neighbour.h	percpu: add __percpu sparse annotations to net	2010-02-16 23:05:38 -08:00
net_namespace.h	nsproxy: remove INIT_NSPROXY()	2010-03-12 15:52:40 -08:00
netdma.h	net_dma: convert to dma_find_channel	2009-01-06 11:38:15 -07:00
netevent.h	…
netlabel.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
netlink.h	netlink: fix unaligned access in nla_get_be64()	2010-03-19 22:47:23 -07:00
netrom.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
nexthop.h	…
nl802154.h	ieee802154: add support for channel pages from IEEE 802.15.4-2006	2009-08-19 23:08:22 +04:00
p8022.h	…
pkt_cls.h	net: rename skb->iif to skb->skb_iif	2009-11-20 15:35:04 -08:00
pkt_sched.h	sched: add head drop fifo queue	2010-01-28 21:27:00 -08:00
protocol.h	net: drop capability from protocol definitions	2009-11-05 21:40:17 -08:00
psnap.h	snap: use const for descriptor	2009-03-21 19:06:50 -07:00
raw.h	…
rawv6.h	ipv6: Use correct data types for ICMPv6 type and code	2009-06-23 04:31:07 -07:00
red.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
regulatory.h	cfg80211: add regulatory hint disconnect support	2010-02-01 15:40:06 -05:00
request_sock.h	tcp: account SYN-ACK timeouts & retransmissions	2010-01-17 19:09:39 -08:00
rose.h	NET: ROSE: Don't use static buffer.	2009-07-26 19:11:14 -07:00
route.h	percpu: add __percpu sparse annotations to net	2010-02-16 23:05:38 -08:00
rtnetlink.h	rtnetlink: support specifying device flags on device creation	2010-02-27 02:43:40 -08:00
sch_generic.h	sched: add head drop fifo queue	2010-01-28 21:27:00 -08:00
scm.h	net: cleanup include/net	2009-11-04 05:06:25 -08:00
slhc_vj.h	…
snmp.h	percpu: add __percpu sparse annotations to net	2010-02-16 23:05:38 -08:00
sock.h	net: fix compile error due to double return type in SOCK_DEBUG	2010-05-02 13:42:39 -07:00
stp.h	net: Add STP demux layer	2008-07-05 21:25:39 -07:00
tcp.h	net: add scheduler sync hint to tcp_prequeue().	2010-03-04 00:53:51 -08:00
tcp_states.h	…
timewait_sock.h	net: Fix memory leak in the proto_register function	2008-11-21 16:45:22 -08:00
transp_v6.h	inet: inet_connection_sock_af_ops const	2009-09-02 01:03:49 -07:00
udp.h	udp: bind() optimisation	2009-11-10 20:54:38 -08:00
udplite.h	udp: introduce struct udp_table and multiple spinlocks	2008-10-29 01:41:45 -07:00
wext.h	wext: refactor	2009-10-07 16:39:43 -04:00
wimax.h	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2009-12-09 19:43:33 -08:00
wpan-phy.h	ieee802154: add support for creation/removal of logic interfaces	2009-11-06 14:32:24 +03:00
x25.h	Merge branch 'master' of /home/davem/src/GIT/linux-2.6/	2010-04-11 02:44:30 -07:00
x25device.h	…
xfrm.h	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00