sst-linux/net/rds
Allison Henderson 2c66293a45 net:rds: Fix possible deadlock in rds_message_put
[ Upstream commit f1acf1ac84d2ae97b7889b87223c1064df850069 ]

Functions rds_still_queued and rds_clear_recv_queue lock a given socket
in order to safely iterate over the incoming rds messages. However
calling rds_inc_put while under this lock creates a potential deadlock.
rds_inc_put may eventually call rds_message_purge, which will lock
m_rs_lock. This is the incorrect locking order since m_rs_lock is
meant to be locked before the socket. To fix this, we move the message
item to a local list or variable that wont need rs_recv_lock protection.
Then we can safely call rds_inc_put on any item stored locally after
rs_recv_lock is released.

Fixes: bdbe6fbc6a ("RDS: recv.c")
Reported-by: syzbot+f9db6ff27b9bfdcfeca0@syzkaller.appspotmail.com
Reported-by: syzbot+dcd73ff9291e6d34b3ab@syzkaller.appspotmail.com
Signed-off-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://lore.kernel.org/r/20240209022854.200292-1-allison.henderson@oracle.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-29 17:30:20 +02:00
..
af_rds.c
bind.c
cong.c net: rds: delete duplicated words 2020-09-18 14:12:43 -07:00
connection.c
ib_cm.c
ib_frmr.c
ib_mr.h RDMA/rds: Remove FMR support for memory registration 2020-06-02 20:32:53 -03:00
ib_rdma.c
ib_recv.c
ib_ring.c
ib_send.c
ib_stats.c
ib_sysctl.c net: Convert uses of typedef ctl_table to struct ctl_table 2013-06-13 02:36:09 -07:00
ib.c
ib.h
info.c rds: fix crash in rds_info_getsockopt() 2020-05-20 14:08:06 -07:00
info.h
Kconfig
loop.c
loop.h
Makefile
message.c
page.c rds: remove dead code 2016-12-26 21:35:39 -05:00
rdma_transport.c
rdma_transport.h
rdma.c net/rds: fix possible cp null dereference 2024-04-10 16:28:25 +02:00
rds_single_path.h
rds.h net: pass a sockptr_t into ->setsockopt 2020-07-24 15:41:54 -07:00
recv.c net:rds: Fix possible deadlock in rds_message_put 2024-08-29 17:30:20 +02:00
send.c rds: introduce acquire/release ordering in acquire/release_in_xmit() 2024-03-26 18:21:00 -04:00
stats.c
sysctl.c
tcp_connect.c net: prevent address rewrite in kernel_bind() 2023-10-19 23:08:50 +02:00
tcp_listen.c
tcp_recv.c
tcp_send.c
tcp_stats.c
tcp.c
tcp.h net: rds: use maybe_get_net() when acquiring refcount on TCP sockets 2022-05-05 16:44:49 -07:00
threads.c
transport.c