tag 52bcdfb6b2bee1bfba6433f3acda098a487fa908
tagger The Android Open Source Project <initial-contribution@android.com> Mon May 20 11:56:15 2019 -0700
object d73c1bf5243eb73be6b8c5c2670d8ab975e05a25

Android Wear 9.0.0 Release 0.21

commit d73c1bf5243eb73be6b8c5c2670d8ab975e05a25
author Sean Tranchetti <stranche@codeaurora.org> Wed Sep 19 17:05:42 2018 -0600
committer abel_fang <Abel_Fang@compal.com> Fri Feb 15 16:03:27 2019 +0800
tree 8cf47ae89a3d68649fd00b14dc401c1fcbe830c9
parent dd736f921b93b5a5c1fb361168edf1fbbbecbc99

af_key: unconditionally clone on broadcast

Attempting to avoid cloning the skb when broadcasting by inflating
the refcount with sock_hold/sock_put while under RCU lock is dangerous
and violates RCU principles. It leads to subtle race conditions when
attempting to free the SKB, as we may reference sockets that have
already been freed by the stack.

Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b
[006b6b6b6b6b6c4b] address between user and kernel address ranges
Internal error: Oops: 96000004 [#1] PREEMPT SMP
task: fffffff78f65b380 task.stack: ffffff8049a88000
pc : sock_rfree+0x38/0x6c
lr : skb_release_head_state+0x6c/0xcc
Process repro (pid: 7117, stack limit = 0xffffff8049a88000)
Call trace:
	sock_rfree+0x38/0x6c
	skb_release_head_state+0x6c/0xcc
	skb_release_all+0x1c/0x38
	__kfree_skb+0x1c/0x30
	kfree_skb+0xd0/0xf4
	pfkey_broadcast+0x14c/0x18c
	pfkey_sendmsg+0x1d8/0x408
	sock_sendmsg+0x44/0x60
	___sys_sendmsg+0x1d0/0x2a8
	__sys_sendmsg+0x64/0xb4
	SyS_sendmsg+0x34/0x4c
	el0_svc_naked+0x34/0x38
Kernel panic - not syncing: Fatal exception

CRs-Fixed: 2251019
Change-Id: Ib3b01f941a34a7df61fe9445f746b7df33f4656a
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>