Ying Xue c756891a4e tipc: fix oops when creating server socket fails ... When creation of TIPC internal server socket fails, we get an oops with the following dump: BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 IP: [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc] PGD 13719067 PUD 12008067 PMD 0 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC Modules linked in: tipc(+) CPU: 4 PID: 4340 Comm: insmod Not tainted 3.10.0+ #1 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 task: ffff880014360000 ti: ffff88001374c000 task.ti: ffff88001374c000 RIP: 0010:[<ffffffffa0011f49>] [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc] RSP: 0018:ffff88001374dc98 EFLAGS: 00010292 RAX: 0000000000000000 RBX: ffff880012ac09d8 RCX: 0000000000000000 RDX: 0000000000000046 RSI: 0000000000000001 RDI: ffff880014360000 RBP: ffff88001374dcb8 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0016fa0 R13: ffffffffa0017010 R14: ffffffffa0017010 R15: ffff880012ac09d8 FS: 0000000000000000(0000) GS:ffff880016600000(0063) knlGS:00000000f76668d0 CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b CR2: 0000000000000020 CR3: 0000000012227000 CR4: 00000000000006e0 Stack: ffff88001374dcb8 ffffffffa0016fa0 0000000000000000 0000000000000001 ffff88001374dcf8 ffffffffa0012922 ffff88001374dce8 00000000ffffffea ffffffffa0017100 0000000000000000 ffff8800134241a8 ffffffffa0017150 Call Trace: [<ffffffffa0012922>] tipc_server_stop+0xa2/0x1b0 [tipc] [<ffffffffa0009995>] tipc_subscr_stop+0x15/0x20 [tipc] [<ffffffffa00130f5>] tipc_core_stop+0x1d/0x33 [tipc] [<ffffffffa001f0d4>] tipc_init+0xd4/0xf8 [tipc] [<ffffffffa001f000>] ? 0xffffffffa001efff [<ffffffff8100023f>] do_one_initcall+0x3f/0x150 [<ffffffff81082f4d>] ? __blocking_notifier_call_chain+0x7d/0xd0 [<ffffffff810cc58a>] load_module+0x11aa/0x19c0 [<ffffffff810c8d60>] ? show_initstate+0x50/0x50 [<ffffffff8190311c>] ? retint_restore_args+0xe/0xe [<ffffffff810cce79>] SyS_init_module+0xd9/0x110 [<ffffffff8190dc65>] sysenter_dispatch+0x7/0x1f Code: 6c 24 70 4c 89 ef e8 b7 04 8f e1 8b 73 04 4c 89 e7 e8 7c 9e 32 e1 41 83 ac 24 b8 00 00 00 01 4c 89 ef e8 eb 0a 8f e1 48 8b 43 08 <4c> 8b 68 20 4d 8d a5 48 03 00 00 4c 89 e7 e8 04 05 8f e1 4c 89 RIP [<ffffffffa0011f49>] tipc_close_conn+0x59/0xb0 [tipc] RSP <ffff88001374dc98> CR2: 0000000000000020 ---[ end trace b02321f40e4269a3 ]--- We have the following call chain: tipc_core_start() ret = tipc_subscr_start() ret = tipc_server_start(){ server->enabled = 1; ret = tipc_open_listening_sock() } I.e., the server->enabled flag is unconditionally set to 1, whatever the return value of tipc_open_listening_sock(). This causes a crash when tipc_core_start() tries to clean up resources after a failed initialization: if (ret == failed) tipc_subscr_stop() tipc_server_stop(){ if (server->enabled) tipc_close_conn(){ NULL reference of con->sock-sk OOPS! } } To avoid this, tipc_server_start() should only set server->enabled to 1 in case of a succesful socket creation. In case of failure, it should release all allocated resources before returning. Problem introduced in commit c5fa7b3cf3 ("tipc: introduce new TIPC server infrastructure") in v3.11-rc1. Note that it won't be seen often; it takes a module load under memory constrained conditions in order to trigger the failure condition. Signed-off-by: Ying Xue <ying.xue@windriver.com> Signed-off-by: Jon Maloy <jon.maloy@ericsson.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-08-01 15:54:33 -07:00
..
addr.c
addr.h
bcast.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
bcast.h	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
bearer.c	tipc: add InfiniBand media type	2013-04-17 14:18:33 -04:00
bearer.h	tipc: add InfiniBand media type	2013-04-17 14:18:33 -04:00
config.c	tipc: convert config_lock from spinlock to mutex	2013-06-17 15:53:01 -07:00
config.h
core.c	tipc: convert configuration server to use new server facility	2013-06-17 15:53:00 -07:00
core.h	tipc: introduce new TIPC server infrastructure	2013-06-17 15:53:00 -07:00
discover.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
discover.h
eth_media.c	tipc: remove dev_base_lock use from enable_bearer	2013-06-17 15:53:01 -07:00
handler.c
ib_media.c	net/tipc: use %*phC to dump small buffers in hex form	2013-07-11 17:03:36 -07:00
Kconfig	tipc: add InfiniBand media type	2013-04-17 14:18:33 -04:00
link.c	tipc: fix wrong return value for link_send_sections_long routine	2013-06-17 15:53:01 -07:00
link.h
log.c
Makefile	tipc: introduce new TIPC server infrastructure	2013-06-17 15:53:00 -07:00
msg.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
msg.h	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
name_distr.c
name_distr.h
name_table.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
name_table.h	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
net.c
net.h
netlink.c	net-next: replace obsolete NLMSG_* with type safe nlmsg_*	2013-03-28 14:25:25 -04:00
node_subscr.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
node_subscr.h
node.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
node.h
port.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
port.h	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
ref.c
ref.h
server.c	tipc: fix oops when creating server socket fails	2013-08-01 15:54:33 -07:00
server.h	tipc: introduce new TIPC server infrastructure	2013-06-17 15:53:00 -07:00
socket.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
subscr.c	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
subscr.h	tipc: cosmetic realignment of function arguments	2013-06-17 15:53:01 -07:00
sysctl.c	tipc: change socket buffer overflow control to respect sk_rcvbuf	2013-06-17 15:53:00 -07:00