Commit 5ec2eeea authored Nov 09, 2015 by Lorenzo Colitti Committed by Subash Abhinov Kasiviswanathan Dec 15, 2015

net: tcp: check for SOCK_DEAD again in tcp_nuke_addr

Liping Zhang spotted a race between tcp_nuke_addr and tcp_close
that can cause a crash. If a userspace process calls tcp_close
on a socket at the same time that tcp_nuke_addr is closing it,
and tcp_close wins the race to call lock_sock, it will call
sock_orphan before releasing the lock. sock_orphan sets the
SOCK_DEAD flag on the socket and proceeds to close it, eventually
calling inet_csk_destroy_sock. When tcp_nuke_addr gets the socket
lock, it calls tcp_done. But if tcp_done sees the SOCK_DEAD flag,
it calls inet_csk_destroy_sock as well, resulting in a double
free.

Fix this by checking for SOCK_DEAD again after lock_sock
succeeds. Eric had already pointed out that this could be a
problem in b/23663111, so there was already a TODO in the code
for this.

Change-Id: I0c87c3fd0598384d957b69734366bd4e2fd7e8d7
Git-commit: 61469ddc534f255c709349a1a611216ecd07e13d
Git-repo: https://android.googlesource.com/kernel/common/


Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

parent 7d4e1b75

net/ipv4/tcp.c

+9 −6

Original line number	Diff line number	Diff line
		@@ -3256,14 +3256,17 @@ restart:
		spin_unlock_bh(lock);

		lock_sock(sk);
		// TODO:
		// Check for SOCK_DEAD again, it could have changed.
		// Add a write barrier, see tcp_reset().
		local_bh_disable();
		bh_lock_sock(sk);

		if (!sock_flag(sk, SOCK_DEAD)) {
		smp_wmb(); /* be consistent with tcp_reset */
		sk->sk_err = ETIMEDOUT;
		sk->sk_error_report(sk);

		tcp_done(sk);
		}

		bh_unlock_sock(sk);
		local_bh_enable();
		release_sock(sk);
		sock_put(sk);