From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx2.suse.de ([195.135.220.15]:38610 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751887AbdECMXi (ORCPT ); Wed, 3 May 2017 08:23:38 -0400 From: Jiri Slaby To: stable@vger.kernel.org Cc: Eric Dumazet , "David S . Miller" , Jiri Slaby Subject: [patch added to 3.12-stable] ping: implement proper locking Date: Wed, 3 May 2017 14:23:03 +0200 Message-Id: <20170503122327.12095-25-jslaby@suse.cz> In-Reply-To: <20170503122327.12095-1-jslaby@suse.cz> References: <20170503122327.12095-1-jslaby@suse.cz> Sender: stable-owner@vger.kernel.org List-ID: From: Eric Dumazet This patch has been added to the 3.12 stable tree. If you have any objections, please let us know. =============== commit 43a6684519ab0a6c52024b5e25322476cabad893 upstream. We got a report of yet another bug in ping http://www.openwall.com/lists/oss-security/2017/03/24/6 ->disconnect() is not called with socket lock held. Fix this by acquiring ping rwlock earlier. Thanks to Daniel, Alexander and Andrey for letting us know this problem. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by: Eric Dumazet Reported-by: Daniel Jiang Reported-by: Solar Designer Reported-by: Andrey Konovalov Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby --- net/ipv4/ping.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 6be49858c86f..3ec2f46cf8fc 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -150,17 +150,18 @@ void ping_hash(struct sock *sk) void ping_unhash(struct sock *sk) { struct inet_sock *isk = inet_sk(sk); + pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num); + write_lock_bh(&ping_table.lock); if (sk_hashed(sk)) { - write_lock_bh(&ping_table.lock); hlist_nulls_del(&sk->sk_nulls_node); sk_nulls_node_init(&sk->sk_nulls_node); sock_put(sk); isk->inet_num = 0; isk->inet_sport = 0; sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); - write_unlock_bh(&ping_table.lock); } + write_unlock_bh(&ping_table.lock); } EXPORT_SYMBOL_GPL(ping_unhash); -- 2.12.2