Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12069401 authored by Jesse Gross's avatar Jesse Gross Committed by David S. Miller
Browse files

geneve: Fix races between socket add and release. 



Currently, searching for a socket to add a reference to is not
synchronized with deletion of sockets. This can result in use
after free if there is another operation that is removing a
socket at the same time. Solving this requires both holding the
appropriate lock and checking the refcount to ensure that it
has not already hit zero.

Inspired by a related (but not exactly the same) issue in the
VXLAN driver.

Fixes: 0b5e8b8e ("net: Add Geneve tunneling protocol driver")
CC: Andy Zhou <azhou@nicira.com>
Signed-off-by: default avatarJesse Gross <jesse@nicira.com>
Acked-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7ed767f7

net/ipv4/geneve.c

+7 −6
Original line number Diff line number Diff line
@@ -296,6 +296,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port, 
				    geneve_rcv_t *rcv, void *data,

				    bool no_share, bool ipv6)

{

	struct geneve_net *gn = net_generic(net, geneve_net_id);

	struct geneve_sock *gs;



	gs = geneve_socket_create(net, port, rcv, data, ipv6);
@@ -305,15 +306,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port, 
	if (no_share)	/* Return error if sharing is not allowed. */

		return ERR_PTR(-EINVAL);



	spin_lock(&gn->sock_lock);

	gs = geneve_find_sock(net, port);

	if (gs) {

		if (gs->rcv == rcv)

			atomic_inc(&gs->refcnt);

		else

	if (gs && ((gs->rcv != rcv) ||

		   !atomic_add_unless(&gs->refcnt, 1, 0)))

			gs = ERR_PTR(-EBUSY);

	} else {

	spin_unlock(&gn->sock_lock);



	if (!gs)

		gs = ERR_PTR(-EINVAL);

	}



	return gs;

}