* [PATCH net-next 0/2] kcm: fix two syzcaller issues
@ 2018-01-24 1:00 Tom Herbert
2018-01-24 1:00 ` [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux Tom Herbert
2018-01-24 1:00 ` [PATCH net-next 2/2] kcm: Check if sk_user_data already set in kcm_attach Tom Herbert
0 siblings, 2 replies; 4+ messages in thread
From: Tom Herbert @ 2018-01-24 1:00 UTC (permalink / raw)
To: davem; +Cc: netdev, rohit, jchapman, Tom Herbert
In this patch set:
- Don't allow attaching non-TCP or listener sockets to a KCM mux.
- In kcm_attach Check if sk_user_data is already set. This is
under lock to avoid race conditions. More work is need to make
all of the users of sk_user_data to use the same locking.
Tom Herbert (2):
kcm: Only allow TCP sockets to be attached to a KCM mux
kcm: Check if sk_user_data already set in kcm_attach
net/kcm/kcmsock.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--
2.11.0
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux
2018-01-24 1:00 [PATCH net-next 0/2] kcm: fix two syzcaller issues Tom Herbert
@ 2018-01-24 1:00 ` Tom Herbert
2018-01-24 15:16 ` Guillaume Nault
2018-01-24 1:00 ` [PATCH net-next 2/2] kcm: Check if sk_user_data already set in kcm_attach Tom Herbert
1 sibling, 1 reply; 4+ messages in thread
From: Tom Herbert @ 2018-01-24 1:00 UTC (permalink / raw)
To: davem; +Cc: netdev, rohit, jchapman, Tom Herbert
TCP sockets for IPv4 and IPv6 that are not listeners or in closed
stated are allowed to be attached to a KCM mux.
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+8865eaff7f9acd593945@syzkaller.appspotmail.com
Signed-off-by: Tom Herbert <tom@quantonium.net>
---
net/kcm/kcmsock.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index d4e98f20fc2a..474ea2200592 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1391,6 +1391,15 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
if (csk->sk_family == PF_KCM)
return -EOPNOTSUPP;
+ /* Only allow TCP sockets to be attached for now */
+ if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
+ csk->sk_protocol != IPPROTO_TCP)
+ return -EOPNOTSUPP;
+
+ /* Don't allow listeners or closed sockets */
+ if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
+ return -EOPNOTSUPP;
+
psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
if (!psock)
return -ENOMEM;
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net-next 2/2] kcm: Check if sk_user_data already set in kcm_attach
2018-01-24 1:00 [PATCH net-next 0/2] kcm: fix two syzcaller issues Tom Herbert
2018-01-24 1:00 ` [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux Tom Herbert
@ 2018-01-24 1:00 ` Tom Herbert
1 sibling, 0 replies; 4+ messages in thread
From: Tom Herbert @ 2018-01-24 1:00 UTC (permalink / raw)
To: davem; +Cc: netdev, rohit, jchapman, Tom Herbert
This is needed to prevent sk_user_data being overwritten.
The check is done under the callback lock. This should prevent
a socket from being attached twice to a KCM mux. It also prevents
a socket from being attached for other use cases of sk_user_data
as long as the other cases set sk_user_data under the lock.
Followup work is needed to unify all the use cases of sk_user_data
to use the same locking.
Reported-by: syzbot+114b15f2be420a8886c3@syzkaller.appspotmail.com
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Tom Herbert <tom@quantonium.net>
---
net/kcm/kcmsock.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 474ea2200592..5ae02a5b0838 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1414,9 +1414,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
return err;
}
- sock_hold(csk);
-
write_lock_bh(&csk->sk_callback_lock);
+
+ /* Check if sk_user_data is aready by KCM or someone else.
+ * Must be done under lock to prevent race conditions.
+ */
+ if (csk->sk_user_data) {
+ write_unlock_bh(&csk->sk_callback_lock);
+ strp_done(&psock->strp);
+ kmem_cache_free(kcm_psockp, psock);
+ return -EALREADY;
+ }
+
psock->save_data_ready = csk->sk_data_ready;
psock->save_write_space = csk->sk_write_space;
psock->save_state_change = csk->sk_state_change;
@@ -1424,8 +1433,11 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
csk->sk_data_ready = psock_data_ready;
csk->sk_write_space = psock_write_space;
csk->sk_state_change = psock_state_change;
+
write_unlock_bh(&csk->sk_callback_lock);
+ sock_hold(csk);
+
/* Finished initialization, now add the psock to the MUX. */
spin_lock_bh(&mux->lock);
head = &mux->psocks;
--
2.11.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux
2018-01-24 1:00 ` [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux Tom Herbert
@ 2018-01-24 15:16 ` Guillaume Nault
0 siblings, 0 replies; 4+ messages in thread
From: Guillaume Nault @ 2018-01-24 15:16 UTC (permalink / raw)
To: Tom Herbert; +Cc: davem, netdev, rohit, jchapman
On Tue, Jan 23, 2018 at 05:00:13PM -0800, Tom Herbert wrote:
> TCP sockets for IPv4 and IPv6 that are not listeners or in closed
> stated are allowed to be attached to a KCM mux.
>
> Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
> Reported-by: syzbot+8865eaff7f9acd593945@syzkaller.appspotmail.com
> Signed-off-by: Tom Herbert <tom@quantonium.net>
> ---
> net/kcm/kcmsock.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
> index d4e98f20fc2a..474ea2200592 100644
> --- a/net/kcm/kcmsock.c
> +++ b/net/kcm/kcmsock.c
> @@ -1391,6 +1391,15 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
> if (csk->sk_family == PF_KCM)
> return -EOPNOTSUPP;
>
> + /* Only allow TCP sockets to be attached for now */
> + if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
> + csk->sk_protocol != IPPROTO_TCP)
> + return -EOPNOTSUPP;
> +
This renders the 'csk->sk_family == PF_KCM' test useless. So why not
removing it?
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-01-24 15:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-01-24 1:00 [PATCH net-next 0/2] kcm: fix two syzcaller issues Tom Herbert
2018-01-24 1:00 ` [PATCH net-next 1/2] kcm: Only allow TCP sockets to be attached to a KCM mux Tom Herbert
2018-01-24 15:16 ` Guillaume Nault
2018-01-24 1:00 ` [PATCH net-next 2/2] kcm: Check if sk_user_data already set in kcm_attach Tom Herbert
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).