Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

geneve: Fix races between socket add and release.

Browse source 
Currently, searching for a socket to add a reference to is not
synchronized with deletion of sockets. This can result in use
after free if there is another operation that is removing a
socket at the same time. Solving this requires both holding the
appropriate lock and checking the refcount to ensure that it
has not already hit zero.

Inspired by a related (but not exactly the same) issue in the
VXLAN driver.

Fixes: 0b5e8b8e ("net: Add Geneve tunneling protocol driver")
CC: Andy Zhou <azhou@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jesse Gross 2014-12-16 18:25:32 -08:00 committed by David S. Miller
parent 7ed767f731
commit 12069401d8
1 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
net/ipv4/geneve.c
View file

@ -296,6 +296,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
geneve_rcv_t *rcv, void *data, geneve_rcv_t *rcv, void *data,
bool no_share, bool ipv6) bool no_share, bool ipv6)
{ {
struct geneve_net *gn = net_generic(net, geneve_net_id);
struct geneve_sock *gs; struct geneve_sock *gs;
gs = geneve_socket_create(net, port, rcv, data, ipv6); gs = geneve_socket_create(net, port, rcv, data, ipv6);
@ -305,15 +306,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
if (no_share) /* Return error if sharing is not allowed. */ if (no_share) /* Return error if sharing is not allowed. */
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
spin_lock(&gn->sock_lock);
gs = geneve_find_sock(net, port); gs = geneve_find_sock(net, port);
if (gs) { if (gs && ((gs->rcv != rcv) ||
if (gs->rcv == rcv) !atomic_add_unless(&gs->refcnt, 1, 0)))
atomic_inc(&gs->refcnt);
else
gs = ERR_PTR(-EBUSY); gs = ERR_PTR(-EBUSY);
} else { spin_unlock(&gn->sock_lock);
if (!gs)
gs = ERR_PTR(-EINVAL); gs = ERR_PTR(-EINVAL);
}
return gs; return gs;
} }