David Howells bf0ca6a1bc rxrpc: Fix oops due to non-existence of prealloc backlog struct ...

commit 880a88f318 upstream.

If an AF_RXRPC service socket is opened and bound, but calls are
preallocated, then rxrpc_alloc_incoming_call() will oops because the
rxrpc_backlog struct doesn't get allocated until the first preallocation is
made.

Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no
backlog struct.  This will cause the incoming call to be aborted.

Reported-by: Junvyyang, Tencent Zhuque Lab <zhuque@tencent.com>
Suggested-by: Junvyyang, Tencent Zhuque Lab <zhuque@tencent.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: LePremierHomme <kwqcheii@proton.me>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Willy Tarreau <w@1wt.eu>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
Link: https://patch.msgid.link/20250708211506.2699012-3-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-07-17 18:25:02 +02:00

..

af_rxrpc.c

rxrpc: Fix deadlock around release of dst cached on udp tunnel

2021-02-10 09:25:27 +01:00

ar-internal.h

rxrpc: Fix decision on when to generate an IDLE ACK

2022-06-14 18:11:38 +02:00

call_accept.c

rxrpc: Fix oops due to non-existence of prealloc backlog struct

2025-07-17 18:25:02 +02:00

call_event.c

rxrpc: Fix calc of resend age

2022-09-28 11:03:58 +02:00

call_object.c

rxrpc: Fix clearance of Tx/Rx ring when releasing a call

2021-02-17 10:35:18 +01:00

conn_client.c

rxrpc: Fix call interruptibility handling

2020-04-17 10:49:57 +02:00

conn_event.c

rxrpc: Fix response to PING RESPONSE ACKs to a dead call

2024-02-23 08:25:07 +01:00

conn_object.c

rxrpc: Fix race between recvmsg and sendmsg on immediate call failure

2020-08-11 15:33:40 +02:00

conn_service.c

rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()

2024-02-23 08:24:55 +01:00

input.c

rxrpc: Fix decision on when to generate an IDLE ACK

2022-06-14 18:11:38 +02:00

insecure.c

rxrpc: Fix -Wframe-larger-than= warnings from on-stack crypto

2019-07-30 10:32:35 -07:00

Kconfig

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

key.c

rxrpc: Fix handling of an unsupported token type in rxrpc_read()

2021-01-23 15:58:00 +01:00

local_event.c

rxrpc: Use the tx-phase skb flag to simplify tracing

2019-08-27 10:04:18 +01:00

local_object.c

rxrpc: Fix local destruction being repeated

2022-09-28 11:03:58 +02:00

Makefile

rxrpc: Fix the excessive initial retransmission timeout

2020-05-27 17:46:48 +02:00

misc.c

rxrpc: Fix the excessive initial retransmission timeout

2020-05-27 17:46:48 +02:00

net_ns.c

rxrpc: Restore removed timer deletion

2022-04-27 13:50:46 +02:00

output.c

rxrpc: Fix ack.bufferSize to be 0 when generating an ack

2023-01-18 11:41:02 +01:00

peer_event.c

rxrpc: Fix the excessive initial retransmission timeout

2020-05-27 17:46:48 +02:00

peer_object.c

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

2021-12-08 09:01:12 +01:00

proc.c

rxrpc: Adjust /proc/net/rxrpc/calls to display call->debug_id not user_ID

2020-06-24 17:50:37 +02:00

protocol.h

rxrpc: Improve jumbo packet counting

2019-08-27 09:48:37 +01:00

recvmsg.c

rxrpc: Fix decision on when to generate an IDLE ACK

2022-06-14 18:11:38 +02:00

rtt.c

rxrpc: Fix _usecs_to_jiffies() by using usecs_to_jiffies()

2021-11-17 09:48:34 +01:00

rxkad.c

rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()

2022-09-15 12:04:55 +02:00

security.c

rxrpc: Fix missing security check on incoming calls

2020-01-17 19:49:05 +01:00

sendmsg.c

rxrpc: Fix hard call timeout units

2023-05-17 11:35:59 +02:00

skbuff.c

rxrpc: Use skb_unshare() rather than skb_cow_data()

2019-08-27 10:13:46 +01:00

sysctl.c

rxrpc: Fix listen() setting the bar too high for the prealloc rings

2022-06-14 18:11:38 +02:00

utils.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36

2019-05-24 17:27:11 +02:00