* [PATCH net] kcm: lock lower socket in kcm_attach
@ 2018-03-12 21:04 Tom Herbert
2018-03-12 21:09 ` Eric Biggers
0 siblings, 1 reply; 4+ messages in thread
From: Tom Herbert @ 2018-03-12 21:04 UTC (permalink / raw)
To: davem; +Cc: netdev, ebiggers3, Tom Herbert
Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.
Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Tom Herbert <tom@quantonium.net>
---
net/kcm/kcmsock.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index f297d53a11aa..34355fd19f27 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
.parse_msg = kcm_parse_func_strparser,
.read_sock_done = kcm_read_sock_done,
};
- int err;
+ int err = 0;
csk = csock->sk;
if (!csk)
return -EINVAL;
+ lock_sock(csk);
+
/* Only allow TCP sockets to be attached for now */
if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
- csk->sk_protocol != IPPROTO_TCP)
- return -EOPNOTSUPP;
+ csk->sk_protocol != IPPROTO_TCP) {
+ err = -EOPNOTSUPP;
+ goto out;
+ }
/* Don't allow listeners or closed sockets */
- if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
- return -EOPNOTSUPP;
+ if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
+ err = -EOPNOTSUPP;
+ goto out;
+ }
psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
- if (!psock)
- return -ENOMEM;
+ if (!psock) {
+ err = -ENOMEM;
+ goto out;
+ }
psock->mux = mux;
psock->sk = csk;
@@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
err = strp_init(&psock->strp, csk, &cb);
if (err) {
kmem_cache_free(kcm_psockp, psock);
- return err;
+ goto out;
}
write_lock_bh(&csk->sk_callback_lock);
@@ -1419,7 +1427,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
write_unlock_bh(&csk->sk_callback_lock);
strp_done(&psock->strp);
kmem_cache_free(kcm_psockp, psock);
- return -EALREADY;
+ err = -EALREADY;
+ goto out;
}
psock->save_data_ready = csk->sk_data_ready;
@@ -1455,7 +1464,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
/* Schedule RX work in case there are already bytes queued */
strp_check_rcv(&psock->strp);
- return 0;
+out:
+ release_sock(csk);
+
+ return err;
}
static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1507,6 +1519,7 @@ static void kcm_unattach(struct kcm_psock *psock)
if (WARN_ON(psock->rx_kcm)) {
write_unlock_bh(&csk->sk_callback_lock);
+ release_sock(csk);
return;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] kcm: lock lower socket in kcm_attach
2018-03-12 21:04 [PATCH net] kcm: lock lower socket in kcm_attach Tom Herbert
@ 2018-03-12 21:09 ` Eric Biggers
2018-03-12 21:25 ` Tom Herbert
0 siblings, 1 reply; 4+ messages in thread
From: Eric Biggers @ 2018-03-12 21:09 UTC (permalink / raw)
To: Tom Herbert; +Cc: davem, netdev
On Mon, Mar 12, 2018 at 02:04:12PM -0700, Tom Herbert wrote:
> Need to lock lower socket in order to provide mutual exclusion
> with kcm_unattach.
>
> Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
> Signed-off-by: Tom Herbert <tom@quantonium.net>
> ---
Is this fixing the syzbot-reported bug "KASAN: use-after-free Read in
get_work_pool"? If so, please add:
Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] kcm: lock lower socket in kcm_attach
2018-03-12 21:09 ` Eric Biggers
@ 2018-03-12 21:25 ` Tom Herbert
2018-03-12 21:33 ` Eric Biggers
0 siblings, 1 reply; 4+ messages in thread
From: Tom Herbert @ 2018-03-12 21:25 UTC (permalink / raw)
To: Eric Biggers
Cc: Tom Herbert, David S. Miller, Linux Kernel Network Developers
On Mon, Mar 12, 2018 at 2:09 PM, Eric Biggers <ebiggers3@gmail.com> wrote:
> On Mon, Mar 12, 2018 at 02:04:12PM -0700, Tom Herbert wrote:
>> Need to lock lower socket in order to provide mutual exclusion
>> with kcm_unattach.
>>
>> Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
>> Signed-off-by: Tom Herbert <tom@quantonium.net>
>> ---
>
> Is this fixing the syzbot-reported bug "KASAN: use-after-free Read in
> get_work_pool"? If so, please add:
>
> Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
Yeah, I was looking for a "reported by". I didn't see it in the email
from syzbot. Where is this found?
Thanks,
Tom
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] kcm: lock lower socket in kcm_attach
2018-03-12 21:25 ` Tom Herbert
@ 2018-03-12 21:33 ` Eric Biggers
0 siblings, 0 replies; 4+ messages in thread
From: Eric Biggers @ 2018-03-12 21:33 UTC (permalink / raw)
To: Tom Herbert; +Cc: Tom Herbert, David S. Miller, Linux Kernel Network Developers
On Mon, Mar 12, 2018 at 02:25:41PM -0700, Tom Herbert wrote:
> On Mon, Mar 12, 2018 at 2:09 PM, Eric Biggers <ebiggers3@gmail.com> wrote:
> > On Mon, Mar 12, 2018 at 02:04:12PM -0700, Tom Herbert wrote:
> >> Need to lock lower socket in order to provide mutual exclusion
> >> with kcm_unattach.
> >>
> >> Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
> >> Signed-off-by: Tom Herbert <tom@quantonium.net>
> >> ---
> >
> > Is this fixing the syzbot-reported bug "KASAN: use-after-free Read in
> > get_work_pool"? If so, please add:
> >
> > Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@syzkaller.appspotmail.com
>
> Yeah, I was looking for a "reported by". I didn't see it in the email
> from syzbot. Where is this found?
>
> Thanks,
> Tom
This was an old bug report that was sent out before syzbot was updated to
suggest a Reported-by line. But you can still use Reported-by for these old
bugs. I took the bug ID from the From: header of the email.
Eric
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-03-12 21:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-03-12 21:04 [PATCH net] kcm: lock lower socket in kcm_attach Tom Herbert
2018-03-12 21:09 ` Eric Biggers
2018-03-12 21:25 ` Tom Herbert
2018-03-12 21:33 ` Eric Biggers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).