rxrpc: Fix read-after-free in rxrpc_queue_local()
authorDavid Howells <dhowells@redhat.com>
Tue, 13 Aug 2019 21:26:36 +0000 (22:26 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Aug 2019 06:28:59 +0000 (08:28 +0200)
commita05354cbb82248469f907712587992c52fd1c254
treec4ca13d61306cba21acc4605143cd7e686442c98
parentf28023c4eedcf0467c887af6eaf5e7d5bf0bf1c4
rxrpc: Fix read-after-free in rxrpc_queue_local()

commit 06d9532fa6b34f12a6d75711162d47c17c1add72 upstream.

rxrpc_queue_local() attempts to queue the local endpoint it is given and
then, if successful, prints a trace line.  The trace line includes the
current usage count - but we're not allowed to look at the local endpoint
at this point as we passed our ref on it to the workqueue.

Fix this by reading the usage count before queuing the work item.

Also fix the reading of local->debug_id for trace lines, which must be done
with the same consideration as reading the usage count.

Fixes: 09d2bf595db4 ("rxrpc: Add a tracepoint to track rxrpc_local refcounting")
Reported-by: syzbot+78e71c5bab4f76a6a719@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/trace/events/rxrpc.h
net/rxrpc/local_object.c