android_kernel_lge_bullhead/net/core
Lorenzo Bianconi a3255c4a1c net: neigh: fix multiple neigh timer scheduling
[ Upstream commit 071c37983d99da07797294ea78e9da1a6e287144 ]

Neigh timer can be scheduled multiple times from userspace adding
multiple neigh entries and forcing the neigh timer scheduling passing
NTF_USE in the netlink requests.
This will result in a refcount leak and in the following dump stack:

[   32.465295] NEIGH: BUG, double timer add, state is 8
[   32.465308] CPU: 0 PID: 416 Comm: double_timer_ad Not tainted 5.2.0+ #65
[   32.465311] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014
[   32.465313] Call Trace:
[   32.465318]  dump_stack+0x7c/0xc0
[   32.465323]  __neigh_event_send+0x20c/0x880
[   32.465326]  ? ___neigh_create+0x846/0xfb0
[   32.465329]  ? neigh_lookup+0x2a9/0x410
[   32.465332]  ? neightbl_fill_info.constprop.0+0x800/0x800
[   32.465334]  neigh_add+0x4f8/0x5e0
[   32.465337]  ? neigh_xmit+0x620/0x620
[   32.465341]  ? find_held_lock+0x85/0xa0
[   32.465345]  rtnetlink_rcv_msg+0x204/0x570
[   32.465348]  ? rtnl_dellink+0x450/0x450
[   32.465351]  ? mark_held_locks+0x90/0x90
[   32.465354]  ? match_held_lock+0x1b/0x230
[   32.465357]  netlink_rcv_skb+0xc4/0x1d0
[   32.465360]  ? rtnl_dellink+0x450/0x450
[   32.465363]  ? netlink_ack+0x420/0x420
[   32.465366]  ? netlink_deliver_tap+0x115/0x560
[   32.465369]  ? __alloc_skb+0xc9/0x2f0
[   32.465372]  netlink_unicast+0x270/0x330
[   32.465375]  ? netlink_attachskb+0x2f0/0x2f0
[   32.465378]  netlink_sendmsg+0x34f/0x5a0
[   32.465381]  ? netlink_unicast+0x330/0x330
[   32.465385]  ? move_addr_to_kernel.part.0+0x20/0x20
[   32.465388]  ? netlink_unicast+0x330/0x330
[   32.465391]  sock_sendmsg+0x91/0xa0
[   32.465394]  ___sys_sendmsg+0x407/0x480
[   32.465397]  ? copy_msghdr_from_user+0x200/0x200
[   32.465401]  ? _raw_spin_unlock_irqrestore+0x37/0x40
[   32.465404]  ? lockdep_hardirqs_on+0x17d/0x250
[   32.465407]  ? __wake_up_common_lock+0xcb/0x110
[   32.465410]  ? __wake_up_common+0x230/0x230
[   32.465413]  ? netlink_bind+0x3e1/0x490
[   32.465416]  ? netlink_setsockopt+0x540/0x540
[   32.465420]  ? __fget_light+0x9c/0xf0
[   32.465423]  ? sockfd_lookup_light+0x8c/0xb0
[   32.465426]  __sys_sendmsg+0xa5/0x110
[   32.465429]  ? __ia32_sys_shutdown+0x30/0x30
[   32.465432]  ? __fd_install+0xe1/0x2c0
[   32.465435]  ? lockdep_hardirqs_off+0xb5/0x100
[   32.465438]  ? mark_held_locks+0x24/0x90
[   32.465441]  ? do_syscall_64+0xf/0x270
[   32.465444]  do_syscall_64+0x63/0x270
[   32.465448]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Fix the issue unscheduling neigh_timer if selected entry is in 'IN_TIMER'
receiving a netlink request with NTF_USE flag set

Reported-by: Marek Majkowski <marek@cloudflare.com>
Fixes: 0c5c2d3089 ("neigh: Allow for user space users of the neighbour table")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic7d6b151d9f63892b5c04a208078f08b46ab6a77
2020-07-11 12:45:38 +02:00
..
Makefile net: sockev: Initial Commit 2014-06-06 17:01:51 -07:00
datagram.c net: Fix skb_set_peeked use-after-free bug 2015-10-01 12:07:36 +02:00
dev.c This is the 3.10.108 stable release 2018-01-25 17:57:49 -07:00
dev_addr_lists.c net/core: dev_mc_sync_multiple calls wrong helper 2013-05-31 16:56:56 -07:00
dev_ioctl.c net: fix kernel deadlock with interface rename and netdev name retrieval. 2013-06-26 13:42:54 -07:00
drop_monitor.c drop_monitor: consider inserted data in genlmsg_end 2017-06-20 14:03:27 +02:00
dst.c net: ratelimit warnings about dst entry refcount underflow or overflow 2017-02-10 11:03:47 +01:00
ethtool.c This is the 3.10.92 stable release 2018-01-25 17:03:31 -07:00
fib_rules.c This is the 3.10.91 stable release 2018-01-25 17:03:22 -07:00
filter.c tcp: take care of truncations done by sk_filter() 2017-02-10 11:03:46 +01:00
flow.c net/core/flow.c: Fix CPU hotplug callback registration 2014-07-03 09:55:32 -07:00
flow_dissector.c net: core: add MAP support to RPS flow dissector 2014-06-23 07:47:38 -06:00
gen_estimator.c
gen_stats.c gen_stats.c: Duplicate xstats buffer for later use 2015-03-18 13:22:26 +01:00
iovec.c iovec: make sure the caller actually wants anything in memcpy_fromiovecend 2017-12-06 00:53:52 +00:00
link_watch.c arch: Mass conversion of smp_mb__*() 2014-08-15 11:45:28 -07:00
neighbour.c net: neigh: fix multiple neigh timer scheduling 2020-07-11 12:45:38 +02:00
net-procfs.c net: Print functions in /proc/net/ptype without the offset. 2013-03-25 14:12:55 -04:00
net-sysfs.c rps_dev_flow_table_release(): no need to delay vfree() 2013-05-06 11:06:51 -04:00
net-sysfs.h
net-traces.c
net_namespace.c netns: provide pure entropy for net_hash_mix() 2020-07-11 12:24:34 +02:00
netevent.c
netpoll.c netpoll: fix the skb check in pkt_is_ns 2014-04-14 06:42:17 -07:00
netprio_cgroup.c Revert "netprio_cgroup: make local table static" 2013-04-12 03:06:44 -04:00
pktgen.c net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() 2015-10-01 12:07:35 +02:00
request_sock.c tcp: fix a panic on UP machines in reqsk_fastopen_remove 2013-01-14 18:10:05 -05:00
rtnetlink.c fix infoleak in rtnetlink 2016-06-15 06:18:13 +00:00
scm.c unix: correctly track in-flight fds in sending process user_struct 2016-03-03 15:06:20 -08:00
secure_seq.c inetpeer: get rid of ip_id_count 2014-08-14 09:24:15 +08:00
skbuff.c This is the 3.10.92 stable release 2018-01-25 17:03:31 -07:00
sock.c net: fix possible overflow in __sk_mem_raise_allocated() 2020-07-11 12:25:53 +02:00
sock_diag.c net: diag: Add the ability to destroy a socket. 2016-01-27 16:38:34 +09:00
sockev_nlmcast.c net: sockev: corrected sk_family filter logic 2015-07-21 16:55:35 -07:00
stream.c tcp: make sure EPOLLOUT wont be missed 2020-07-11 12:42:42 +02:00
sysctl_net_core.c This is the 3.10.73 stable release 2015-05-01 13:49:45 -07:00
timestamping.c
user_dma.c
utils.c net: core: let's use native isxdigit instead of custom 2013-03-27 12:48:32 -04:00