linux/net/rds
Allison Henderson f1acf1ac84 net:rds: Fix possible deadlock in rds_message_put
Functions rds_still_queued and rds_clear_recv_queue lock a given socket
in order to safely iterate over the incoming rds messages. However
calling rds_inc_put while under this lock creates a potential deadlock.
rds_inc_put may eventually call rds_message_purge, which will lock
m_rs_lock. This is the incorrect locking order since m_rs_lock is
meant to be locked before the socket. To fix this, we move the message
item to a local list or variable that wont need rs_recv_lock protection.
Then we can safely call rds_inc_put on any item stored locally after
rs_recv_lock is released.

Fixes: bdbe6fbc6a ("RDS: recv.c")
Reported-by: syzbot+f9db6ff27b9bfdcfeca0@syzkaller.appspotmail.com
Reported-by: syzbot+dcd73ff9291e6d34b3ab@syzkaller.appspotmail.com
Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@oracle.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2024-02-13 10:25:30 +01:00
..
af_rds.c net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv 2024-01-22 11:24:00 +00:00
bind.c
cong.c
connection.c
ib.c
ib.h
ib_cm.c
ib_frmr.c
ib_mr.h
ib_rdma.c
ib_recv.c
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c
info.c
info.h
Kconfig
loop.c
loop.h
Makefile
message.c rds: rds_rm_zerocopy_callback() correct order for list_add_tail() 2023-02-13 09:33:39 +00:00
page.c
rdma.c
rdma_transport.c net: rds: Fix possible NULL-pointer dereference 2023-09-20 08:49:03 +01:00
rdma_transport.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rds.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
rds_single_path.h
recv.c net:rds: Fix possible deadlock in rds_message_put 2024-02-13 10:25:30 +01:00
send.c
stats.c
sysctl.c
tcp.c networking: Update to register_net_sysctl_sz 2023-08-15 15:26:18 -07:00
tcp.h net/rds: Remove unused function declarations 2023-08-13 12:25:42 +01:00
tcp_connect.c net: prevent address rewrite in kernel_bind() 2023-10-01 19:31:29 +01:00
tcp_listen.c ipv6: annotate data-races around np->mcast_oif 2023-12-11 10:59:17 +00:00
tcp_recv.c
tcp_send.c rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage 2023-06-24 15:50:12 -07:00
tcp_stats.c
threads.c
transport.c