Go to file
Jon Maloy c3317f4db8 tipc: fix unbalanced reference counter
When a topology subscription is created, we may encounter (or KASAN
may provoke) a failure to create a corresponding service instance in
the binding table. Instead of letting the tipc_nametbl_subscribe()
report the failure back to the caller, the function just makes a warning
printout and returns, without incrementing the subscription reference
counter as expected by the caller.

This makes the caller believe that the subscription was successful, so
it will at a later moment try to unsubscribe the item. This involves
a sub_put() call. Since the reference counter never was incremented
in the first place, we get a premature delete of the subscription item,
followed by a "use-after-free" warning.

We fix this by adding a return value to tipc_nametbl_subscribe() and
make the caller aware of the failure to subscribe.

This bug seems to always have been around, but this fix only applies
back to the commit shown below. Given the low risk of this happening
we believe this to be sufficient.

Fixes: commit 218527fe27 ("tipc: replace name table service range
array with rb tree")
Reported-by: syzbot+aa245f26d42b8305d157@syzkaller.appspotmail.com

Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-04-12 21:46:10 -04:00
Documentation IOMMU Updates for Linux v4.17 2018-04-11 18:50:41 -07:00
LICENSES
arch xen: fixes for 4.17-rc1 2018-04-12 11:04:35 -07:00
block for-4.17/block-20180402 2018-04-05 14:27:02 -07:00
certs
crypto MIPS changes for 4.17 2018-04-10 11:39:22 -07:00
drivers lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables 2018-04-12 21:46:10 -04:00
firmware
fs This pull request contains updates for both UBI and UBIFS: 2018-04-11 16:39:34 -07:00
include lan78xx: PHY DSP registers initialization to address EEE link drop issues with long cables 2018-04-12 21:46:10 -04:00
init seq_file: allocate seq_file from kmem_cache 2018-04-11 10:28:36 -07:00
ipc ipc/shm.c: shm_split(): remove unneeded test for NULL shm_file_data.vm_ops 2018-04-11 10:28:38 -07:00
kernel * Fix 2032 time access issues and new compiler warnings 2018-04-12 10:21:19 -07:00
lib Fix for one swiotlb regression in 2.16 from Takashi. 2018-04-12 11:00:48 -07:00
mm page cache: use xa_lock 2018-04-11 10:28:39 -07:00
net tipc: fix unbalanced reference counter 2018-04-12 21:46:10 -04:00
samples remoteproc updates for v4.17 2018-04-10 12:09:27 -07:00
scripts asm-generic fixes for v4.17-rc1 2018-04-12 09:15:48 -07:00
security ipc/msg: introduce msgctl(MSG_STAT_ANY) 2018-04-11 10:28:37 -07:00
sound sound fixes for 4.17-rc1 2018-04-10 10:16:04 -07:00
tools These commits have either been sitting in my INBOX or have been 2018-04-11 16:42:27 -07:00
usr
virt KVM/ARM updates for v4.17 2018-03-28 16:09:09 +02:00
.clang-format clang-format: add configuration file 2018-04-11 10:28:35 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore clang-format: add configuration file 2018-04-11 10:28:35 -07:00
.mailmap Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS ARM: SoC fixes for 4.17 2018-04-11 16:12:21 -07:00
Makefile Kconfig updates for v4.17 2018-04-03 16:28:01 -07:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.