Ka-Cheong Poon 84eef2b218 rds: Incorrect reference counting in TCP socket creation ...

Commit 0933a578cd ("rds: tcp: use sock_create_lite() to create the
accept socket") has a reference counting issue in TCP socket creation
when accepting a new connection.  The code uses sock_create_lite() to
create a kernel socket.  But it does not do __module_get() on the
socket owner.  When the connection is shutdown and sock_release() is
called to free the socket, the owner's reference count is decremented
and becomes incorrect.  Note that this bug only shows up when the socket
owner is configured as a kernel module.

v2: Update comments

Fixes: 0933a578cd ("rds: tcp: use sock_create_lite() to create the accept socket")
Signed-off-by: Ka-Cheong Poon <ka-cheong.poon@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-03-02 09:40:27 -05:00

..

af_rds.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

bind.c

rds; Reset rs->rs_bound_addr in rds_add_bound() failure path

2017-12-27 13:37:27 -05:00

cong.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

connection.c

rds: do not call ->conn_alloc with GFP_KERNEL

2018-02-13 13:52:02 -05:00

ib_cm.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

ib_fmr.c

…

ib_frmr.c

…

ib_mr.h

…

ib_rdma.c

…

ib_recv.c

…

ib_ring.c

…

ib_send.c

…

ib_stats.c

…

ib_sysctl.c

…

ib.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

ib.h

…

info.c

…

info.h

…

Kconfig

…

loop.c

…

loop.h

…

Makefile

…

message.c

…

page.c

…

rdma_transport.c

…

rdma_transport.h

…

rdma.c

RDS: null pointer dereference in rds_atomic_free_op

2018-01-04 14:19:26 -05:00

rds_single_path.h

…

rds.h

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

recv.c

…

send.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

stats.c

…

sysctl.c

…

tcp_connect.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_listen.c

rds: Incorrect reference counting in TCP socket creation

2018-03-02 09:40:27 -05:00

tcp_recv.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_send.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp_stats.c

…

tcp.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

tcp.h

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2018-01-23 13:51:56 -05:00

threads.c

rds: tcp: use rds_destroy_pending() to synchronize netns/module teardown and rds connection/workq management

2018-02-08 15:23:52 -05:00

transport.c

…