diff options
| author | David Howells <dhowells@redhat.com> | 2020-09-14 15:26:47 +0300 |
|---|---|---|
| committer | David Howells <dhowells@redhat.com> | 2020-09-14 18:18:59 +0300 |
| commit | 546a42410bf76075e157dbdd94c097b3bc44b25a (patch) | |
| tree | 9c576d97bdd35811f085a4e0575af4b7d77590c4 /net/rxrpc | |
| parent | 8806245a3e7ad6aafc5bd8c58b0f0dea82a8e4c5 (diff) | |
| download | linux-546a42410bf76075e157dbdd94c097b3bc44b25a.tar.xz | |
rxrpc: Fix conn bundle leak in net-namespace exit
When the network namespace exits, rxrpc_clean_up_local_conns() needs to
unbundle each client connection it evicts. Fix it to do this.
kernel BUG at net/rxrpc/conn_object.c:481!
RIP: 0010:rxrpc_destroy_all_connections.cold+0x11/0x13 net/rxrpc/conn_object.c:481
Call Trace:
rxrpc_exit_net+0x1a4/0x2e0 net/rxrpc/net_ns.c:119
ops_exit_list+0xb0/0x160 net/core/net_namespace.c:186
cleanup_net+0x4ea/0xa00 net/core/net_namespace.c:603
process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
kthread+0x3b5/0x4a0 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Fixes: 245500d853e9 ("rxrpc: Rewrite the client connection manager")
Reported-by: syzbot+52071f826a617b9c76ed@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'net/rxrpc')
| -rw-r--r-- | net/rxrpc/conn_client.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c index 180be4da8d26..0eb36ba52485 100644 --- a/net/rxrpc/conn_client.c +++ b/net/rxrpc/conn_client.c @@ -1112,6 +1112,7 @@ void rxrpc_clean_up_local_conns(struct rxrpc_local *local) conn = list_entry(graveyard.next, struct rxrpc_connection, cache_link); list_del_init(&conn->cache_link); + rxrpc_unbundle_conn(conn); rxrpc_put_connection(conn); } |