linux-kernel - [PATCH] rxrpc: Fix oops due to abort delegated to rxrpc_input_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <167180363292.2552292.16128486005167315554.stgit@warthog.procyon.org.uk>
Date:   Fri, 23 Dec 2022 13:53:52 +0000
From:   David Howells <dhowells@...hat.com>
To:     marc.dionne@...istor.com
Cc:     dhowells@...hat.com, linux-afs@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] rxrpc: Fix oops due to abort delegated to
 rxrpc_input_call_event()

When sendmsg or recvmsg delegate an abort to the I/O thread, this is
processed by rxrpc_input_call_event().  But this may get called before the
call is connected, in which case call->conn might be NULL still.  This can
cause an oops, whereby we go on from aborting the call to trying to emit
ACKs and the attempt to allocate a txbuf for the ACK goes splat:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    ...
    RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157
    ...
    Call Trace:
     rxrpc_send_ACK+0x50/0x13b
     rxrpc_input_call_event+0x1bc/0x68b
     rxrpc_io_thread+0x1b6/0x45f
     kthread+0xe7/0xef
     ret_from_fork+0x22/0x30

Fix this by going to the cleanup in rxrpc_input_call_event() and skipping
the ACK generation stuff, etc. if we complete the delegation of an ABORT
packet.

Signed-off-by: David Howells <dhowells@...hat.com>
cc: Marc Dionne <marc.dionne@...istor.com>
cc: linux-afs@...ts.infradead.org
---

 net/rxrpc/call_event.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index 148bb7fc0415..ce3cad298449 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -395,9 +395,11 @@ bool rxrpc_input_call_event(struct rxrpc_call *call, struct sk_buff *skb)
 	}
 
 	abort_code = smp_load_acquire(&call->send_abort);
-	if (abort_code)
+	if (abort_code) {
 		rxrpc_abort_call(call, 0, call->send_abort, call->send_abort_err,
 				 call->send_abort_why);
+		goto out;
+	}
 
 	if (skb && skb->mark == RXRPC_SKB_MARK_ERROR)
 		goto out;