From: Eric Dumazet <[email protected]>
Date: Wed, 24 Apr 2019 09:44:11 -0700
> After commit 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook"),
> rxrpc_input_packet() is directly called from lockless UDP receive
> path, under rcu_read_lock() protection.
>
> It must therefore use RCU rules :
>
> - udp_sk->sk_user_data can be cleared at any point in this function.
> rcu_dereference_sk_user_data() is what we need here.
>
> - Also, since sk_user_data might have been set in rxrpc_open_socket()
> we must observe a proper RCU grace period before kfree(local) in
> rxrpc_lookup_local()
>
> v4: @local can be NULL in xrpc_lookup_local() as reported by kbuild test
> robot <[email protected]>
> and Julia Lawall <[email protected]>, thanks !
>
> v3,v2 : addressed David Howells feedback, thanks !
>
> syzbot reported :
...
> Fixes: 5271953cad31 ("rxrpc: Use the UDP encap_rcv hook")
> Signed-off-by: Eric Dumazet <[email protected]>
> Reported-by: syzbot <[email protected]>
> Acked-by: David Howells <[email protected]>
Applied and queued up for v4.19+ -stable.
Thanks.
