From patchwork Tue Mar 13 19:01:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom Herbert X-Patchwork-Id: 885425 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=quantonium.net Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=quantonium-net.20150623.gappssmtp.com header.i=@quantonium-net.20150623.gappssmtp.com header.b="VL3WdV7T"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40143Q2t8Jz9sT0 for ; Wed, 14 Mar 2018 06:02:10 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752509AbeCMTCF (ORCPT ); Tue, 13 Mar 2018 15:02:05 -0400 Received: from mail-pl0-f68.google.com ([209.85.160.68]:46705 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751606AbeCMTCB (ORCPT ); Tue, 13 Mar 2018 15:02:01 -0400 Received: by mail-pl0-f68.google.com with SMTP id f5-v6so333149plj.13 for ; Tue, 13 Mar 2018 12:02:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quantonium-net.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=KGokgD6PJWeAG5xy1770XEsBlEvAhQJo+7Z5IjRoB3I=; b=VL3WdV7TjB+Y7iU/k8UC0UTtXGS6HgVJjPsbYIMmLfcOSsnNC6h754DElom39XcytO UWghXVRr5x4bgHGcIF7Z/ChoXlowd2HTiSLA16IJsSQfz6VdXydQ6EXU6bFNBLbunrWM 1qPTys57GHoEhS7ptZPOy4iWf9amJciXJuLcpsJfiYu7bgyCwDv5zFDidtqScGk6hVoE YEeijRhZu/+43tz9YGgJysNaaZMEb4HjFqSMwHcVe4u7QV5YMEoeiuCdfSaDRDebRQc9 hFpayhRZODWWzqah2Cw+8xdmGeH5m5Ti9AScDGr8hsTcrxt0yNqHmMaUT7Ai8kf/9zKM tyrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=KGokgD6PJWeAG5xy1770XEsBlEvAhQJo+7Z5IjRoB3I=; b=n0dSxDkDPZEOjKVXildnkZmagJAwmWkecUYU2EHRocSIaRfpevunljVfzJajn8BnpI 7Gm4PGhyE/0a0nZJnH/Tp0EBe369G/bTDxiR5LALYjRvP95tPi5RZwCRYbERxzURPf2D pud4H/655Sb08+dUTrbAnTtTUmXchN5grq3t1wCWBx4A0Xba359zNjgkzgE71j30x+z4 gE5Ldu2/r4vQmWSVVE3vjMsjdIV4ru4zdhQEXwSV5jIfrPrN3eWRM8cNtRSqCEEqzcWG uYbFpBa2txruCyFiQdXydCIWz1Ktop8Y9/fImY0/SvaVLagU/A398zZ9f8sWj6rRO7+Q gCug== X-Gm-Message-State: AElRT7GZvtt6tm3zLRv04Uz4rlQDvkaFaDwL7GkmAKonDvGDYsVOlhpR FzHXuQOXl2398c3C2TTs+k5kNLWk X-Google-Smtp-Source: AG47ELtDlzhhrjM/0RE2cqJNxmkHY6pwu49rYrfWyaEvN/i9AqEh/wYT8CAwq9N9yFy1AvMrOYIZCQ== X-Received: by 2002:a17:902:44c:: with SMTP id 70-v6mr1517183ple.354.1520967720313; Tue, 13 Mar 2018 12:02:00 -0700 (PDT) Received: from localhost.localdomain (67-207-98-108.static.wiline.com. [67.207.98.108]) by smtp.gmail.com with ESMTPSA id p12sm1171420pgn.91.2018.03.13.12.01.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Mar 2018 12:01:59 -0700 (PDT) From: Tom Herbert To: davem@davemloft.net Cc: netdev@vger.kernel.org, ebiggers3@gmail.com, Tom Herbert Subject: [PATCH v2 net] kcm: lock lower socket in kcm_attach Date: Tue, 13 Mar 2018 12:01:43 -0700 Message-Id: <20180313190143.1980-1-tom@quantonium.net> X-Mailer: git-send-email 2.11.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Need to lock lower socket in order to provide mutual exclusion with kcm_unattach. v2: Add Reported-by for syzbot Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com Signed-off-by: Tom Herbert --- net/kcm/kcmsock.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index f297d53a11aa..34355fd19f27 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock, .parse_msg = kcm_parse_func_strparser, .read_sock_done = kcm_read_sock_done, }; - int err; + int err = 0; csk = csock->sk; if (!csk) return -EINVAL; + lock_sock(csk); + /* Only allow TCP sockets to be attached for now */ if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || - csk->sk_protocol != IPPROTO_TCP) - return -EOPNOTSUPP; + csk->sk_protocol != IPPROTO_TCP) { + err = -EOPNOTSUPP; + goto out; + } /* Don't allow listeners or closed sockets */ - if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) - return -EOPNOTSUPP; + if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) { + err = -EOPNOTSUPP; + goto out; + } psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); - if (!psock) - return -ENOMEM; + if (!psock) { + err = -ENOMEM; + goto out; + } psock->mux = mux; psock->sk = csk; @@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock, err = strp_init(&psock->strp, csk, &cb); if (err) { kmem_cache_free(kcm_psockp, psock); - return err; + goto out; } write_lock_bh(&csk->sk_callback_lock); @@ -1419,7 +1427,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock, write_unlock_bh(&csk->sk_callback_lock); strp_done(&psock->strp); kmem_cache_free(kcm_psockp, psock); - return -EALREADY; + err = -EALREADY; + goto out; } psock->save_data_ready = csk->sk_data_ready; @@ -1455,7 +1464,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock, /* Schedule RX work in case there are already bytes queued */ strp_check_rcv(&psock->strp); - return 0; +out: + release_sock(csk); + + return err; } static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) @@ -1507,6 +1519,7 @@ static void kcm_unattach(struct kcm_psock *psock) if (WARN_ON(psock->rx_kcm)) { write_unlock_bh(&csk->sk_callback_lock); + release_sock(csk); return; }