• David Howells's avatar
    rxrpc: Fix potential call vs socket/net destruction race · d3be4d24
    David Howells authored
    rxrpc_call structs don't pin sockets or network namespaces, but may attempt
    to access both after their refcount reaches 0 so that they can detach
    themselves from the network namespace.  However, there's no guarantee that
    the socket still exists at this point (so sock_net(&call->socket->sk) may
    be invalid) and the namespace may have gone away if the call isn't pinning
    a peer.
    
    Fix this by (a) carrying a net pointer in the rxrpc_call struct and (b)
    waiting for all calls to be destroyed when the network namespace goes away.
    
    This was detected by checker:
    
    net/rxrpc/call_object.c:634:57: warning: incorrect type in argument 1 (different address spaces)
    net/rxrpc/call_object.c:634:57:    expected struct sock const *sk
    net/rxrpc/call_object.c:634:57:    got struct sock [noderef] <asn:4>*<noident>
    
    Fixes: 2baec2c3 ("rxrpc: Support network namespacing")
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    d3be4d24
call_object.c 18.9 KB