Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 406996f3 authored by Tom Herbert's avatar Tom Herbert Committed by Greg Kroah-Hartman
Browse files

kcm: lock lower socket in kcm_attach 




[ Upstream commit 2cc683e88c0c993ac3721d9b702cb0630abe2879 ]

Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.

v2: Add Reported-by for syzbot

Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module")
Reported-by: default avatar <syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com>
Signed-off-by: default avatarTom Herbert <tom@quantonium.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 002f4557

net/kcm/kcmsock.c

+23 −10
Original line number Diff line number Diff line
@@ -1375,24 +1375,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock, 
	struct list_head *head;

	int index = 0;

	struct strp_callbacks cb;

	int err;

	int err = 0;



	csk = csock->sk;

	if (!csk)

		return -EINVAL;



	lock_sock(csk);



	/* Only allow TCP sockets to be attached for now */

	if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||

	    csk->sk_protocol != IPPROTO_TCP)

		return -EOPNOTSUPP;

	    csk->sk_protocol != IPPROTO_TCP) {

		err = -EOPNOTSUPP;

		goto out;

	}



	/* Don't allow listeners or closed sockets */

	if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)

		return -EOPNOTSUPP;

	if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {

		err = -EOPNOTSUPP;

		goto out;

	}



	psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);

	if (!psock)

		return -ENOMEM;

	if (!psock) {

		err = -ENOMEM;

		goto out;

	}



	psock->mux = mux;

	psock->sk = csk;
@@ -1406,7 +1414,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock, 
	err = strp_init(&psock->strp, csk, &cb);

	if (err) {

		kmem_cache_free(kcm_psockp, psock);

		return err;

		goto out;

	}



	write_lock_bh(&csk->sk_callback_lock);
@@ -1418,7 +1426,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock, 
		write_unlock_bh(&csk->sk_callback_lock);

		strp_done(&psock->strp);

		kmem_cache_free(kcm_psockp, psock);

		return -EALREADY;

		err = -EALREADY;

		goto out;

	}



	psock->save_data_ready = csk->sk_data_ready;
@@ -1454,7 +1463,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock, 
	/* Schedule RX work in case there are already bytes queued */

	strp_check_rcv(&psock->strp);



	return 0;

out:

	release_sock(csk);



	return err;

}



static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1506,6 +1518,7 @@ static void kcm_unattach(struct kcm_psock *psock) 


	if (WARN_ON(psock->rx_kcm)) {

		write_unlock_bh(&csk->sk_callback_lock);

		release_sock(csk);

		return;

	}