[PATCH 4.9 27/28] kcm: lock lower socket in kcm_attach

From: Greg Kroah-Hartman
Date: Thu Mar 29 2018 - 14:17:16 EST


4.9-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tom Herbert <tom@xxxxxxxxxxxxxx>


[ Upstream commit 2cc683e88c0c993ac3721d9b702cb0630abe2879 ]

Need to lock lower socket in order to provide mutual exclusion
with kcm_unattach.

v2: Add Reported-by for syzbot

Fixes: ab7ac4eb9832e32a09f4e804 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+ea75c0ffcd353d32515f064aaebefc5279e6161e@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Tom Herbert <tom@xxxxxxxxxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/kcm/kcmsock.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)

--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1375,24 +1375,32 @@ static int kcm_attach(struct socket *soc
struct list_head *head;
int index = 0;
struct strp_callbacks cb;
- int err;
+ int err = 0;

csk = csock->sk;
if (!csk)
return -EINVAL;

+ lock_sock(csk);
+
/* Only allow TCP sockets to be attached for now */
if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
- csk->sk_protocol != IPPROTO_TCP)
- return -EOPNOTSUPP;
+ csk->sk_protocol != IPPROTO_TCP) {
+ err = -EOPNOTSUPP;
+ goto out;
+ }

/* Don't allow listeners or closed sockets */
- if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
- return -EOPNOTSUPP;
+ if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
+ err = -EOPNOTSUPP;
+ goto out;
+ }

psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
- if (!psock)
- return -ENOMEM;
+ if (!psock) {
+ err = -ENOMEM;
+ goto out;
+ }

psock->mux = mux;
psock->sk = csk;
@@ -1406,7 +1414,7 @@ static int kcm_attach(struct socket *soc
err = strp_init(&psock->strp, csk, &cb);
if (err) {
kmem_cache_free(kcm_psockp, psock);
- return err;
+ goto out;
}

write_lock_bh(&csk->sk_callback_lock);
@@ -1418,7 +1426,8 @@ static int kcm_attach(struct socket *soc
write_unlock_bh(&csk->sk_callback_lock);
strp_done(&psock->strp);
kmem_cache_free(kcm_psockp, psock);
- return -EALREADY;
+ err = -EALREADY;
+ goto out;
}

psock->save_data_ready = csk->sk_data_ready;
@@ -1454,7 +1463,10 @@ static int kcm_attach(struct socket *soc
/* Schedule RX work in case there are already bytes queued */
strp_check_rcv(&psock->strp);

- return 0;
+out:
+ release_sock(csk);
+
+ return err;
}

static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1506,6 +1518,7 @@ static void kcm_unattach(struct kcm_psoc

if (WARN_ON(psock->rx_kcm)) {
write_unlock_bh(&csk->sk_callback_lock);
+ release_sock(csk);
return;
}