Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5b1db1c authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Greg Kroah-Hartman
Browse files

net: Unpublish sk from sk_reuseport_cb before call_rcu 



[ Upstream commit 8c7138b33e5c690c308b2a7085f6313fdcb3f616 ]

The "reuse->sock[]" array is shared by multiple sockets.  The going away
sk must unpublish itself from "reuse->sock[]" before making call_rcu()
call.  However, this unpublish-action is currently done after a grace
period and it may cause use-after-free.

The fix is to move reuseport_detach_sock() to sk_destruct().
Due to the above reason, any socket with sk_reuseport_cb has
to go through the rcu grace period before freeing it.

It is a rather old bug (~3 yrs).  The Fixes tag is not necessary
the right commit but it is the one that introduced the SOCK_RCU_FREE
logic and this fix is depending on it.

Fixes: a4298e45 ("net: add SOCK_RCU_FREE socket flag")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Suggested-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9d0995cc

net/core/sock.c

+8 −3
Original line number Diff line number Diff line
@@ -1563,8 +1563,6 @@ static void __sk_destruct(struct rcu_head *head) 
		sk_filter_uncharge(sk, filter);

		RCU_INIT_POINTER(sk->sk_filter, NULL);

	}

	if (rcu_access_pointer(sk->sk_reuseport_cb))

		reuseport_detach_sock(sk);



	sock_disable_timestamp(sk, SK_FLAGS_TIMESTAMP);
@@ -1587,7 +1585,14 @@ static void __sk_destruct(struct rcu_head *head) 


void sk_destruct(struct sock *sk)

{

	if (sock_flag(sk, SOCK_RCU_FREE))

	bool use_call_rcu = sock_flag(sk, SOCK_RCU_FREE);



	if (rcu_access_pointer(sk->sk_reuseport_cb)) {

		reuseport_detach_sock(sk);

		use_call_rcu = true;

	}



	if (use_call_rcu)

		call_rcu(&sk->sk_rcu, __sk_destruct);

	else

		__sk_destruct(&sk->sk_rcu);