diff mbox series

[5.9,245/255] net/x25: Fix null-ptr-deref in x25_connect

Message ID	20201117122150.853348655@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Martin Schiller <ms@dev.tdt.de>, Xie He <xie.he.0141@gmail.com>, Jakub Kicinski <kuba@kernel.org> Subject: [PATCH 5.9 245/255] net/x25: Fix null-ptr-deref in x25_connect Date: Tue, 17 Nov 2020 14:06:25 +0100 Message-Id: <20201117122150.853348655@linuxfoundation.org> In-Reply-To: <20201117122138.925150709@linuxfoundation.org> References: <20201117122138.925150709@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.9,006/255] xfrm: interface: fix the priorities for ipip and ipv6 tunnels [5.9,007/255] ASoC: Intel: kbl_rt5663_max98927: Fix kabylake_ssp_fixup function [5.9,008/255] genirq: Let GENERIC_IRQ_IPI select IRQ_DOMAIN_HIERARCHY [5.9,011/255] ASoC: codecs: wsa881x: add missing stream rates and format [5.9,013/255] irqchip/sifive-plic: Fix broken irq_set_affinity() callback [5.9,015/255] kunit: Dont fail test suites if one of them is empty [5.9,016/255] usb: gadget: fsl: fix null pointer checking [5.9,017/255] selftests: filter kselftest headers from command in lib.mk [5.9,018/255] ASoC: codecs: wcd934x: Set digital gain range correctly [5.9,019/255] ASoC: codecs: wcd9335: Set digital gain range correctly [5.9,022/255] mac80211: dont require VHT elements for HE on 2.4 GHz [5.9,023/255] netfilter: nftables: fix netlink report logic in flowtable and genid [5.9,024/255] netfilter: use actual socket sk rather than skb sk when routing harder [5.9,025/255] netfilter: nf_tables: missing validation from the abort path [5.9,026/255] PCI: Always enable ACS even if no ACS Capability [5.9,030/255] drm/vc4: bo: Add a managed action to cleanup the cache [5.9,031/255] IB/srpt: Fix memory leak in srpt_add_one [5.9,033/255] drm/panfrost: rename error labels in device_init [5.9,037/255] perf tools: Add missing swap for ino_generation [5.9,039/255] ALSA: hda: prevent undefined shift in snd_hdac_ext_bus_get_link() [5.9,042/255] afs: Fix warning due to unadvanced marshalling pointer [5.9,043/255] afs: Fix incorrect freeing of the ACL passed to the YFS ACL store op [5.9,046/255] can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context [5.9,047/255] can: dev: __can_get_echo_skb(): fix real payload length return value for RTR frames [5.9,048/255] can: can_create_echo_skb(): fix echo skb generation: always use skb_clone() [5.9,050/255] can: j1939: j1939_sk_bind(): return failure if netdev is down [5.9,053/255] can: peak_usb: add range checking in decode operations [5.9,055/255] can: peak_canfd: pucan_handle_can_rx(): fix echo management when loopback is on [5.9,056/255] can: flexcan: remove FLEXCAN_QUIRK_DISABLE_MECR quirk for LS1021A [5.9,057/255] can: flexcan: flexcan_remove(): disable wakeup completely [5.9,058/255] xfs: flush new eof page on truncate to avoid post-eof corruption [5.9,059/255] xfs: fix missing CoW blocks writeback conversion retry [5.9,061/255] io_uring: ensure consistent view of original task ->mm from SQPOLL [5.9,063/255] PCI: mvebu: Fix duplicate resource requests [5.9,066/255] selftests: clone3: use SKIP instead of XFAIL [5.9,069/255] kbuild: explicitly specify the build id style [5.9,071/255] USB: apple-mfi-fastcharge: fix reference leak in apple_mfi_fc_set_property [5.9,074/255] ath9k_htc: Use appropriate rs_datalen type [5.9,076/255] ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015 [5.9,077/255] ASoC: qcom: sdm845: set driver name correctly [5.9,080/255] usb: dwc3: pci: add support for the Intel Alder Lake-S [5.9,081/255] opp: Reduce the size of critical section in _opp_table_kref_release() [5.9,082/255] usb: gadget: goku_udc: fix potential crashes in probe [5.9,087/255] ALSA: hda: Reinstate runtime_allow() for all hda controllers [5.9,089/255] gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free [5.9,090/255] gfs2: Add missing truncate_inode_pages_final for sd_aspace [5.9,092/255] scsi: hpsa: Fix memory leak in hpsa_init_one() [5.9,093/255] drm/amdgpu: perform srbm soft reset always on SDMA resume [5.9,094/255] drm/amd/pm: correct the baco reset sequence for CI ASICs [5.9,096/255] drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running [5.9,099/255] mac80211: always wind down STA state [5.9,100/255] cfg80211: regulatory: Fix inconsistent format argument [5.9,101/255] wireguard: selftests: check that route_me_harder packets use the right sk [5.9,102/255] tracing: Fix the checking of stackidx in __ftrace_trace_stack [5.9,104/255] ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline [5.9,106/255] scsi: mpt3sas: Fix timeouts observed while reenabling IRQ [5.9,108/255] nvme-rdma: avoid race between time out and tear down [5.9,109/255] nvme-tcp: avoid race between time out and tear down [5.9,110/255] nvme-rdma: avoid repeated request completion [5.9,113/255] s390/smp: move rcu_cpu_starting() earlier [5.9,114/255] vfio: platform: fix reference leak in vfio_platform_open [5.9,116/255] i2c: mediatek: move dma reset before i2c reset [5.9,117/255] amd/amdgpu: Disable VCN DPG mode for Picasso [5.9,121/255] riscv: Set text_offset correctly for M-Mode [5.9,123/255] i2c: designware: call i2c_dw_read_clear_intrbits_slave() once [5.9,126/255] spi: bcm2835: remove use of uninitialized gpio flags variable [5.9,128/255] pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm [5.9,130/255] gpio: aspeed: fix ast2600 bank properties [5.9,131/255] ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe template [5.9,133/255] libbpf, hashmap: Fix undefined behavior in hash_bits [5.9,134/255] pinctrl: mcp23s08: Use full chunk of memory for regmap configuration [5.9,135/255] pinctrl: aspeed: Fix GPI only function problem. [5.9,138/255] net/mlx5e: Use spin_lock_bh for async_icosq_lock [5.9,140/255] net/mlx5: E-switch, Avoid extack error log for disabled vport [5.9,141/255] net/mlx5e: Fix VXLAN synchronization after function reload [5.9,143/255] SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() [5.9,146/255] tools/bpftool: Fix attaching flow dissector [5.9,149/255] r8169: disable hw csum for short packets on all chip versions [5.9,151/255] pinctrl: qcom: sm8250: Specify PDC map [5.9,153/255] selftest: fix flower terse dump tests [5.9,155/255] igc: Fix returning wrong statistics [5.9,157/255] net: phy: realtek: support paged operations on RTL8201CP [5.9,160/255] xfs: fix rmap key and record comparison functions [5.9,161/255] xfs: fix brainos in the refcount scrubbers rmap fragment processor [5.9,162/255] lan743x: fix "BUG: invalid wait context" when setting rx mode [5.9,164/255] of/address: Fix of_node memory leak in of_dma_is_coherent [5.9,167/255] cosa: Add missing kfree in error path of cosa_write [5.9,168/255] hwmon: (applesmc) Re-work SMC comms [5.9,170/255] vrf: Fix fast path output packet handling with async Netfilter rules [5.9,171/255] lan743x: fix use of uninitialized variable [5.9,172/255] arm64/mm: Validate hotplug range before creating linear mapping [5.9,176/255] perf: Fix get_recursion_context() [5.9,178/255] nvme: freeze the queue over ->lba_shift updates [5.9,179/255] nvme: fix incorrect behavior when BLKROSET is called by the user [5.9,180/255] perf: Simplify group_sched_in() [5.9,182/255] firmware: xilinx: fix out-of-bounds access [5.9,184/255] erofs: derive atime instead of leaving it empty [5.9,186/255] ext4: unlock xattr_sem properly in ext4_inline_data_truncate() [5.9,191/255] KVM: arm64: Dont hide ID registers from userspace [5.9,193/255] speakup ttyio: Do not schedule() in ttyio_in_nowait [5.9,195/255] thunderbolt: Fix memory leak if ida_simple_get() fails in enumerate_services() [5.9,197/255] block: add a return value to set_capacity_revalidate_and_notify [5.9,201/255] usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode [5.9,202/255] usb: typec: ucsi: Report power supply changes [5.9,204/255] virtio: virtio_console: fix DMA memory allocation for rproc serial [5.9,205/255] mei: protect mei_cl_mtu from null dereference [5.9,206/255] futex: Dont enable IRQs unconditionally in put_pi_state() [5.9,207/255] jbd2: fix up sparse warnings in checkpoint code [5.9,210/255] mm/compaction: stop isolation if too many pages are isolated and we have pages to m... [5.9,213/255] mm/gup: use unpin_user_pages() in __gup_longterm_locked() [5.9,214/255] Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" [5.9,215/255] reboot: fix overflow parsing reboot cpu number [5.9,216/255] hugetlbfs: fix anon huge page migration race [5.9,221/255] gpio: sifive: Fix SiFive gpio probe [5.9,223/255] gpio: pcie-idio-24: Fix IRQ Enable Register value [5.9,226/255] mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove [5.9,227/255] dont dump the threads that had been already exiting when zapped. [5.9,229/255] drm/i915: Correctly set SFC capability for video engines [5.9,232/255] pinctrl: amd: use higher precision for 512 RtcClk [5.9,234/255] swiotlb: fix "x86: Dont panic if can not alloc buffer for swiotlb" [5.9,237/255] cpufreq: Add strict_target to struct cpufreq_policy [5.9,238/255] cpufreq: intel_pstate: Take CPUFREQ_GOV_STRICT_TARGET into account [5.9,239/255] ethtool: netlink: add missing netdev_features_change() call [5.9,241/255] net/af_iucv: fix null pointer dereference on shutdown [5.9,242/255] net: udp: fix IP header access and skb lookup on Fast/frag0 UDP GRO [5.9,245/255] net/x25: Fix null-ptr-deref in x25_connect [5.9,246/255] tipc: fix memory leak in tipc_topsrv_start() [5.9,248/255] mptcp: provide rmem[0] limit [5.9,250/255] powerpc/603: Always fault when _PAGE_ACCESSED is not set [5.9,253/255] coresight: etm: perf: Sink selection using sysfs is deprecated [5.9,254/255] coresight: Fix uninitialised pointer bug in etm_setup_aux() [5.9,255/255] Convert trailing spaces and periods in path components

Commit Message

Greg KH Nov. 17, 2020, 1:06 p.m. UTC

From: Martin Schiller <ms@dev.tdt.de>

[ Upstream commit 361182308766a265b6c521879b34302617a8c209 ]

This fixes a regression for blocking connects introduced by commit
4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect").

The x25->neighbour is already set to "NULL" by x25_disconnect() now,
while a blocking connect is waiting in
x25_wait_for_connection_establishment(). Therefore x25->neighbour must
not be accessed here again and x25->state is also already set to
X25_STATE_0 by x25_disconnect().

Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Reviewed-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201109065449.9014-1-ms@dev.tdt.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/af_x25.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -825,7 +825,7 @@  static int x25_connect(struct socket *so
 	sock->state = SS_CONNECTED;
 	rc = 0;
 out_put_neigh:
-	if (rc) {
+	if (rc && x25->neighbour) {
 		read_lock_bh(&x25_list_lock);
 		x25_neigh_put(x25->neighbour);
 		x25->neighbour = NULL;