Parthasarathy Bhuvaragan 458be024ef tipc: remove subscription references only for pending timers ... In commit, 139bb36f75 ("tipc: advance the time of deleting subscription from subscriber->subscrp_list"), we delete the subscription from the subscribers list and from nametable unconditionally. This leads to the following bug if the timer running tipc_subscrp_timeout() in another CPU accesses the subscription list after the subscription delete request. [39.570] general protection fault: 0000 [#1] SMP :: [39.574] task: ffffffff81c10540 task.stack: ffffffff81c00000 [39.575] RIP: 0010:tipc_subscrp_timeout+0x32/0x80 [tipc] [39.576] RSP: 0018:ffff88003ba03e90 EFLAGS: 00010282 [39.576] RAX: dead000000000200 RBX: ffff88003f0f3600 RCX: 0000000000000101 [39.577] RDX: dead000000000100 RSI: 0000000000000201 RDI: ffff88003f0d7948 [39.578] RBP: ffff88003ba03ea0 R08: 0000000000000001 R09: ffff88003ba03ef8 [39.579] R10: 000000000000014f R11: 0000000000000000 R12: ffff88003f0d7948 [39.580] R13: ffff88003f0f3618 R14: ffffffffa006c250 R15: ffff88003f0f3600 [39.581] FS: 0000000000000000(0000) GS:ffff88003ba00000(0000) knlGS:0000000000000000 [39.582] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [39.583] CR2: 00007f831c6e0714 CR3: 000000003d3b0000 CR4: 00000000000006f0 [39.584] Call Trace: [39.584] <IRQ> [39.585] call_timer_fn+0x3d/0x180 [39.585] ? tipc_subscrb_rcv_cb+0x260/0x260 [tipc] [39.586] run_timer_softirq+0x168/0x1f0 [39.586] ? sched_clock_cpu+0x16/0xc0 [39.587] __do_softirq+0x9b/0x2de [39.587] irq_exit+0x60/0x70 [39.588] smp_apic_timer_interrupt+0x3d/0x50 [39.588] apic_timer_interrupt+0x86/0x90 [39.589] RIP: 0010:default_idle+0x20/0xf0 [39.589] RSP: 0018:ffffffff81c03e58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 [39.590] RAX: 0000000000000000 RBX: ffffffff81c10540 RCX: 0000000000000000 [39.591] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [39.592] RBP: ffffffff81c03e68 R08: 0000000000000000 R09: 0000000000000000 [39.593] R10: ffffc90001cbbe00 R11: 0000000000000000 R12: 0000000000000000 [39.594] R13: ffffffff81c10540 R14: 0000000000000000 R15: 0000000000000000 [39.595] </IRQ> :: [39.603] RIP: tipc_subscrp_timeout+0x32/0x80 [tipc] RSP: ffff88003ba03e90 [39.604] ---[ end trace 79ce94b7216cb459 ]--- Fixes: 139bb36f75 ("tipc: advance the time of deleting subscription from subscriber->subscrp_list") Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-08-22 14:25:02 -07:00
..
addr.c
addr.h	tipc: introduce constants for tipc address validation	2016-07-26 14:26:42 -07:00
bcast.c	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
bcast.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
bearer.c	tipc: accept PACKET_MULTICAST packets	2017-08-14 11:19:25 -07:00
bearer.h	tipc: add function for checking broadcast support in bearer	2017-01-20 12:10:15 -05:00
core.c	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
core.h	netns: make struct pernet_operations::id unsigned int	2016-11-18 10:59:15 -05:00
discover.c	tipc: allocate user memory with GFP_KERNEL flag	2017-01-16 13:31:53 -05:00
discover.h
eth_media.c
ib_media.c
Kconfig
link.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
link.h	tipc: transfer broadcast nacks in link state messages	2016-09-02 17:10:24 -07:00
Makefile	tipc: add neighbor monitoring framework	2016-06-15 14:06:28 -07:00
monitor.c	tipc: improve sanity check for received domain records	2016-11-25 20:06:18 -05:00
monitor.h	tipc: dump monitor attributes	2016-07-26 14:26:42 -07:00
msg.c	tipc: avoid inheriting msg_non_seq flag when message is returned	2017-08-14 11:20:36 -07:00
msg.h	tipc: introduce replicast as transport option for multicast	2017-01-20 12:10:17 -05:00
name_distr.c	tipc: allocate user memory with GFP_KERNEL flag	2017-01-16 13:31:53 -05:00
name_distr.h
name_table.c	tipc: adjust the policy of holding subscription kref	2017-03-28 18:03:33 -07:00
name_table.h	tipc: add functionality to lookup multicast destination nodes	2017-01-20 12:10:16 -05:00
net.c	netlink: pass extended ACK struct where available	2017-04-13 13:58:22 -04:00
net.h	tipc: add peer removal functionality	2016-08-18 23:36:07 -07:00
netlink_compat.c	tipc: fix use-after-free	2017-08-18 15:59:29 -07:00
netlink.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
netlink.h	tipc: make cluster size threshold for monitoring configurable	2016-07-26 14:26:42 -07:00
node.c	tipc: remove premature ESTABLISH FSM event at link synchronization	2017-08-09 22:38:06 -07:00
node.h	tipc: make replicast a user selectable option	2017-01-20 12:10:17 -05:00
server.c	tipc: fix cleanup at module unload	2017-01-24 16:14:58 -05:00
server.h
socket.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
socket.h	tipc: redesign connection-level flow control	2016-05-03 15:51:16 -04:00
subscr.c	tipc: remove subscription references only for pending timers	2017-08-22 14:25:02 -07:00
subscr.h	tipc: adjust the policy of holding subscription kref	2017-03-28 18:03:33 -07:00
sysctl.c
udp_media.c	netlink: pass extended ACK struct to parsing functions	2017-04-13 13:58:22 -04:00
udp_media.h	tipc: add UDP remoteip dump to netlink API	2016-08-26 21:38:41 -07:00