When adding a new connection to the bundle, the old connection was not
removed from the bundle before being dropped, potentially hitting:
kernel BUG at net/rxrpc/conn_client.c:64!
RIP: 0010:rxrpc_destroy_client_conn_ids net/rxrpc/conn_client.c:64 [inline]
RIP: 0010:rxrpc_purge_client_connections+0xc0/0x1a0 net/rxrpc/conn_client.c:145
Call Trace:
rxrpc_destroy_local+0x262/0x300 net/rxrpc/local_object.c:451
rxrpc_io_thread+0x2e1a/0x3820 net/rxrpc/io_thread.c:579
Old connections that cannot be reused need to be unbundled.
Reported-by: syzbot+e2f5927fc701355ef101@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e2f5927fc701355ef101
Tested-by: syzbot+e2f5927fc701355ef101@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
net/rxrpc/conn_client.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 48519f0de185..9f13520be249 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -335,6 +335,7 @@ int rxrpc_look_up_bundle(struct rxrpc_call *call, gfp_t gfp)
/*
* Allocate a new connection and add it into a bundle.
*/
+static void rxrpc_unbundle_conn(struct rxrpc_connection *conn);
static bool rxrpc_add_conn_to_bundle(struct rxrpc_bundle *bundle,
unsigned int slot)
{
@@ -344,6 +345,7 @@ static bool rxrpc_add_conn_to_bundle(struct rxrpc_bundle *bundle,
old = bundle->conns[slot];
if (old) {
+ rxrpc_unbundle_conn(old);
bundle->conns[slot] = NULL;
bundle->conn_ids[slot] = 0;
trace_rxrpc_client(old, -1, rxrpc_client_replace);
--
2.43.0