Lorenzo Bianconi a3255c4a1c net: neigh: fix multiple neigh timer scheduling ... [ Upstream commit 071c37983d99da07797294ea78e9da1a6e287144 ] Neigh timer can be scheduled multiple times from userspace adding multiple neigh entries and forcing the neigh timer scheduling passing NTF_USE in the netlink requests. This will result in a refcount leak and in the following dump stack: [ 32.465295] NEIGH: BUG, double timer add, state is 8 [ 32.465308] CPU: 0 PID: 416 Comm: double_timer_ad Not tainted 5.2.0+ #65 [ 32.465311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014 [ 32.465313] Call Trace: [ 32.465318] dump_stack+0x7c/0xc0 [ 32.465323] __neigh_event_send+0x20c/0x880 [ 32.465326] ? ___neigh_create+0x846/0xfb0 [ 32.465329] ? neigh_lookup+0x2a9/0x410 [ 32.465332] ? neightbl_fill_info.constprop.0+0x800/0x800 [ 32.465334] neigh_add+0x4f8/0x5e0 [ 32.465337] ? neigh_xmit+0x620/0x620 [ 32.465341] ? find_held_lock+0x85/0xa0 [ 32.465345] rtnetlink_rcv_msg+0x204/0x570 [ 32.465348] ? rtnl_dellink+0x450/0x450 [ 32.465351] ? mark_held_locks+0x90/0x90 [ 32.465354] ? match_held_lock+0x1b/0x230 [ 32.465357] netlink_rcv_skb+0xc4/0x1d0 [ 32.465360] ? rtnl_dellink+0x450/0x450 [ 32.465363] ? netlink_ack+0x420/0x420 [ 32.465366] ? netlink_deliver_tap+0x115/0x560 [ 32.465369] ? __alloc_skb+0xc9/0x2f0 [ 32.465372] netlink_unicast+0x270/0x330 [ 32.465375] ? netlink_attachskb+0x2f0/0x2f0 [ 32.465378] netlink_sendmsg+0x34f/0x5a0 [ 32.465381] ? netlink_unicast+0x330/0x330 [ 32.465385] ? move_addr_to_kernel.part.0+0x20/0x20 [ 32.465388] ? netlink_unicast+0x330/0x330 [ 32.465391] sock_sendmsg+0x91/0xa0 [ 32.465394] ___sys_sendmsg+0x407/0x480 [ 32.465397] ? copy_msghdr_from_user+0x200/0x200 [ 32.465401] ? _raw_spin_unlock_irqrestore+0x37/0x40 [ 32.465404] ? lockdep_hardirqs_on+0x17d/0x250 [ 32.465407] ? __wake_up_common_lock+0xcb/0x110 [ 32.465410] ? __wake_up_common+0x230/0x230 [ 32.465413] ? netlink_bind+0x3e1/0x490 [ 32.465416] ? netlink_setsockopt+0x540/0x540 [ 32.465420] ? __fget_light+0x9c/0xf0 [ 32.465423] ? sockfd_lookup_light+0x8c/0xb0 [ 32.465426] __sys_sendmsg+0xa5/0x110 [ 32.465429] ? __ia32_sys_shutdown+0x30/0x30 [ 32.465432] ? __fd_install+0xe1/0x2c0 [ 32.465435] ? lockdep_hardirqs_off+0xb5/0x100 [ 32.465438] ? mark_held_locks+0x24/0x90 [ 32.465441] ? do_syscall_64+0xf/0x270 [ 32.465444] do_syscall_64+0x63/0x270 [ 32.465448] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fix the issue unscheduling neigh_timer if selected entry is in 'IN_TIMER' receiving a netlink request with NTF_USE flag set Reported-by: Marek Majkowski <marek@cloudflare.com> Fixes: 0c5c2d3089 ("neigh: Allow for user space users of the neighbour table") Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com> Reviewed-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Ic7d6b151d9f63892b5c04a208078f08b46ab6a77		2020-07-11 12:45:38 +02:00
..
9p	p9_client_readdir() fix	2017-06-20 14:04:52 +02:00
802	…
8021q	net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev	2017-11-02 07:16:25 +01:00
appletalk	appletalk: Fix socket referencing in skb	2014-07-28 08:00:05 -07:00
atm	arch: Mass conversion of smp_mb__*()	2014-08-15 11:45:28 -07:00
ax25	net: add validation for the socket syscall protocol argument	2016-01-22 19:47:55 -08:00
batman-adv	batman-adv: Fix broadcast/ogm queue limit on a removed interface	2016-06-07 10:42:53 +02:00
bluetooth	Bluetooth: LLVMLinux: Remove VLAIS from bluetooth/amp.c	2019-08-26 17:34:10 +02:00
bridge	Android 8.1.0 Release 0.92	2018-08-06 12:09:43 -07:00
caif	This is the 3.10.81 stable release	2018-01-25 16:45:35 -07:00
can	can: bcm: fix hrtimer/tasklet termination in bcm op removal	2017-06-20 14:03:12 +02:00
ceph	libceph: force GFP_NOIO for socket allocations	2017-06-20 14:04:38 +02:00
core	net: neigh: fix multiple neigh timer scheduling	2020-07-11 12:45:38 +02:00
dcb	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-06-26 15:12:37 -04:00
dccp	This is the 3.10.107 stable release	2018-01-25 17:57:41 -07:00
decnet	decnet: Do not build routes to devices without decnet private data.	2016-06-07 10:42:54 +02:00
dns_resolver	dns_resolver: Null-terminate the right string	2014-07-28 08:00:06 -07:00
dsa	…
ethernet	…
ieee802154	net: 6lowpan: fix lowpan_header_create non-compression memcpy call	2017-06-08 00:47:00 +02:00
ipc_router	net: ipc_router: Register services only on client port	2017-01-18 23:11:00 +00:00
ipv4	inet: update the IP ID generation algorithm to higher standards.	2020-07-11 12:43:52 +02:00
ipv6	inet: update the IP ID generation algorithm to higher standards.	2020-07-11 12:43:52 +02:00
ipx	ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg	2014-12-06 15:05:47 -08:00
irda	irda: Fix lockdep annotations in hashbin_delete().	2017-06-20 14:04:21 +02:00
iucv	Merge upstream tag 'v3.10.49' into msm-3.10	2014-08-20 13:23:09 -07:00
key	This is the 3.10.108 stable release	2018-01-25 17:57:49 -07:00
l2tp	This is the 3.10.107 stable release	2018-01-25 17:57:41 -07:00
lapb	…
llc	net: fix infoleak in llc	2016-06-07 10:42:54 +02:00
mac80211	This is the 3.10.107 stable release	2018-01-25 17:57:41 -07:00
mac802154	…
netfilter	nf_conntrack: Null pointer check added prior deleting sip node	2019-08-26 17:13:09 +02:00
netlabel	netlabel: add address family checks to netlbl_{sock,req}_delattr()	2016-08-27 11:40:37 +02:00
netlink	This is the 3.10.90 stable release	2018-01-25 17:02:20 -07:00
netrom	…
nfc	NFC: Add sockaddr length checks before accessing sa_family in bind handlers	2019-08-26 17:12:28 +02:00
openvswitch	openvswitch: fix panic with multiple vlan headers	2014-10-15 08:31:57 +02:00
packet	Android 8.1.0 Release 0.36 (OPM5.171019.017,angler)	2018-03-05 16:22:23 -07:00
phonet	This is the 3.10.96 stable release	2018-01-25 17:06:17 -07:00
rds	This is the 3.10.107 stable release	2018-01-25 17:57:41 -07:00
rfkill	This is the 3.10.103 stable release	2018-01-25 17:26:32 -07:00
rmnet_data	net: rmnet_data: Fix incorrect netlink handling	2017-01-19 06:16:16 +00:00
rose	…
rxrpc	This is the 3.10.108 stable release	2018-01-25 17:57:49 -07:00
sched	This is the 3.10.106 stable release	2018-01-25 17:54:29 -07:00
sctp	This is the 3.10.108 stable release	2018-01-25 17:57:49 -07:00
sunrpc	This is the 3.10.106 stable release	2018-01-25 17:54:29 -07:00
tipc	net/tipc: initialize security state for new connection socket	2015-10-01 12:07:35 +02:00
unix	This is the 3.10.107 stable release	2018-01-25 17:57:41 -07:00
vmw_vsock	VSOCK: do not disconnect socket when peer has shutdown SEND only	2016-06-07 10:42:54 +02:00
wimax	…
wireless	cfg80211: wext: Reject malformed SSID elements	2020-07-11 12:43:36 +02:00
x25	net: fix a kernel infoleak in x25 module	2016-06-07 10:42:54 +02:00
xfrm	This is the 3.10.108 stable release	2018-01-25 17:57:49 -07:00
Kconfig	kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanly	2014-07-09 13:21:25 +03:00
Makefile	…
activity_stats.c	…
compat.c	net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour	2015-03-26 15:00:56 +01:00
nonet.c	…
socket.c	This is the 3.10.106 stable release	2018-01-25 17:54:29 -07:00
sysctl_net.c	…