Allison Henderson 6cee13d8d4 net:rds: Fix possible deadlock in rds_message_put ...

[ Upstream commit f1acf1ac84 ]

Functions rds_still_queued and rds_clear_recv_queue lock a given socket
in order to safely iterate over the incoming rds messages. However
calling rds_inc_put while under this lock creates a potential deadlock.
rds_inc_put may eventually call rds_message_purge, which will lock
m_rs_lock. This is the incorrect locking order since m_rs_lock is
meant to be locked before the socket. To fix this, we move the message
item to a local list or variable that wont need rs_recv_lock protection.
Then we can safely call rds_inc_put on any item stored locally after
rs_recv_lock is released.

Fixes: bdbe6fbc6a ("RDS: recv.c")
Reported-by: syzbot+f9db6ff27b9bfdcfeca0@syzkaller.appspotmail.com
Reported-by: syzbot+dcd73ff9291e6d34b3ab@syzkaller.appspotmail.com
Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@oracle.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-08-19 06:04:27 +02:00

..

af_rds.c

net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv

2024-01-31 16:19:01 -08:00

bind.c

treewide: use get_random_{u8,u16}() when possible, part 2

2022-10-11 17:42:58 -06:00

cong.c

…

connection.c

rds: memory leak in __rds_conn_create()

2021-12-14 12:51:52 +00:00

ib_cm.c

rds: ib: Remove two ib_modify_qp() calls

2021-04-12 19:51:48 -03:00

ib_frmr.c

net/rds: dma_map_sg is entitled to merge entries

2021-08-18 15:35:50 -07:00

ib_mr.h

…

ib_rdma.c

…

ib_recv.c

net: add missing includes of linux/sched/clock.h

2023-01-27 11:19:46 +00:00

ib_ring.c

rds: Fix spelling mistakes

2021-05-31 22:45:05 -07:00

ib_send.c

rds: Remove redundant assignment to nr_sig

2021-04-27 14:14:33 -07:00

ib_stats.c

…

ib_sysctl.c

…

ib.c

RDMA: Split kernel-only global device caps from uverbs device caps

2022-04-06 15:02:13 -03:00

ib.h

…

info.c

…

info.h

…

Kconfig

…

loop.c

…

loop.h

…

Makefile

…

message.c

rds: rds_rm_zerocopy_callback() correct order for list_add_tail()

2023-02-13 09:33:39 +00:00

page.c

…

rdma_transport.c

net: rds: Fix possible NULL-pointer dereference

2023-09-20 08:49:03 +01:00

rdma_transport.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

rdma.c

net/rds: fix possible cp null dereference

2024-04-10 16:35:49 +02:00

rds_single_path.h

…

rds.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

recv.c

net:rds: Fix possible deadlock in rds_message_put

2024-08-19 06:04:27 +02:00

send.c

rds: introduce acquire/release ordering in acquire/release_in_xmit()

2024-03-26 18:20:11 -04:00

stats.c

…

sysctl.c

…

tcp_connect.c

net: prevent address rewrite in kernel_bind()

2023-10-01 19:31:29 +01:00

tcp_listen.c

net: prevent address rewrite in kernel_bind()

2023-10-01 19:31:29 +01:00

tcp_recv.c

net/sock: Introduce trace_sk_data_ready()

2023-01-23 11:26:50 +00:00

tcp_send.c

rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage

2023-06-24 15:50:12 -07:00

tcp_stats.c

…

tcp.c

networking: Update to register_net_sysctl_sz

2023-08-15 15:26:18 -07:00

tcp.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

threads.c

rds: Fix fall-through warnings for Clang

2021-05-17 20:00:27 -05:00

transport.c

…