• David Howells's avatar
    rxrpc: Fix conn bundle leak in net-namespace exit · 546a4241
    David Howells authored
    When the network namespace exits, rxrpc_clean_up_local_conns() needs to
    unbundle each client connection it evicts.  Fix it to do this.
    
    kernel BUG at net/rxrpc/conn_object.c:481!
    RIP: 0010:rxrpc_destroy_all_connections.cold+0x11/0x13 net/rxrpc/conn_object.c:481
    Call Trace:
     rxrpc_exit_net+0x1a4/0x2e0 net/rxrpc/net_ns.c:119
     ops_exit_list+0xb0/0x160 net/core/net_namespace.c:186
     cleanup_net+0x4ea/0xa00 net/core/net_namespace.c:603
     process_one_work+0x94c/0x1670 kernel/workqueue.c:2269
     worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
     kthread+0x3b5/0x4a0 kernel/kthread.c:292
     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
    
    Fixes: 245500d8 ("rxrpc: Rewrite the client connection manager")
    Reported-by: syzbot+52071f826a617b9c76ed@syzkaller.appspotmail.com
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    546a4241
conn_client.c 28.7 KB