UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

kcm: lock lower socket in kcm_attach 

Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.

v2: Add Reported-by for syzbot

Fixes: ab7ac4eb98 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
Signed-off-by: Tom Herbert <tom@quantonium.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Tom Herbert 2018-03-13 12:01:43 -07:00 committed by David S. Miller
parent e693be293f
commit 2cc683e88c
1 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
net/kcm/kcmsock.c
View File

@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
.parse_msg = kcm_parse_func_strparser, .parse_msg = kcm_parse_func_strparser,
.read_sock_done = kcm_read_sock_done, .read_sock_done = kcm_read_sock_done,
}; };
int err; int err = 0;
csk = csock->sk; csk = csock->sk;
if (!csk) if (!csk)
return -EINVAL; return -EINVAL;
lock_sock(csk);
/* Only allow TCP sockets to be attached for now */ /* Only allow TCP sockets to be attached for now */
if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
csk->sk_protocol != IPPROTO_TCP) csk->sk_protocol != IPPROTO_TCP) {
return -EOPNOTSUPP; err = -EOPNOTSUPP;
goto out;
}
/* Don't allow listeners or closed sockets */ /* Don't allow listeners or closed sockets */
if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
return -EOPNOTSUPP; err = -EOPNOTSUPP;
goto out;
}
psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
if (!psock) if (!psock) {
return -ENOMEM; err = -ENOMEM;
goto out;
}
psock->mux = mux; psock->mux = mux;
psock->sk = csk; psock->sk = csk;
@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
err = strp_init(&psock->strp, csk, &cb); err = strp_init(&psock->strp, csk, &cb);
if (err) { if (err) {
kmem_cache_free(kcm_psockp, psock); kmem_cache_free(kcm_psockp, psock);
return err; goto out;
} }
write_lock_bh(&csk->sk_callback_lock); write_lock_bh(&csk->sk_callback_lock);
@ -1419,7 +1427,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
write_unlock_bh(&csk->sk_callback_lock); write_unlock_bh(&csk->sk_callback_lock);
strp_done(&psock->strp); strp_done(&psock->strp);
kmem_cache_free(kcm_psockp, psock); kmem_cache_free(kcm_psockp, psock);
return -EALREADY; err = -EALREADY;
goto out;
} }
psock->save_data_ready = csk->sk_data_ready; psock->save_data_ready = csk->sk_data_ready;
@ -1455,7 +1464,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
/* Schedule RX work in case there are already bytes queued */ /* Schedule RX work in case there are already bytes queued */
strp_check_rcv(&psock->strp); strp_check_rcv(&psock->strp);
return 0; out:
release_sock(csk);
return err;
} }
static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@ -1507,6 +1519,7 @@ static void kcm_unattach(struct kcm_psock *psock)
if (WARN_ON(psock->rx_kcm)) { if (WARN_ON(psock->rx_kcm)) {
write_unlock_bh(&csk->sk_callback_lock); write_unlock_bh(&csk->sk_callback_lock);
release_sock(csk);
return; return;
} }