geneve: Fix races between socket add and release. (12069401) · Commits · 戴 / test

Currently, searching for a socket to add a reference to is not synchronized with deletion of sockets. This can result in use after free if there is another operation that is removing a socket at the same time. Solving this requires both holding the appropriate lock and checking the refcount to ensure that it has not already hit zero. Inspired by a related (but not exactly the same) issue in the VXLAN driver. Fixes: ("net: Add Geneve tunneling protocol driver") CC: Andy Zhou <azhou@nicira.com> Signed-off-by:

Jesse Gross <jesse@nicira.com> Acked-by:

Thomas Graf <tgraf@suug.ch> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/geneve.c

+7 −6

Original line number	Diff line number	Diff line
		@@ -296,6 +296,7 @@ struct geneve_sock geneve_sock_add(struct net net, __be16 port,
		geneve_rcv_t rcv, void data,
		bool no_share, bool ipv6)
		{
		struct geneve_net *gn = net_generic(net, geneve_net_id);
		struct geneve_sock *gs;

		gs = geneve_socket_create(net, port, rcv, data, ipv6);
		@@ -305,15 +306,15 @@ struct geneve_sock geneve_sock_add(struct net net, __be16 port,
		if (no_share) /* Return error if sharing is not allowed. */
		return ERR_PTR(-EINVAL);

		spin_lock(&gn->sock_lock);
		gs = geneve_find_sock(net, port);
		if (gs) {
		if (gs->rcv == rcv)
		atomic_inc(&gs->refcnt);
		else
		if (gs && ((gs->rcv != rcv) \|\|
		!atomic_add_unless(&gs->refcnt, 1, 0)))
		gs = ERR_PTR(-EBUSY);
		} else {
		spin_unlock(&gn->sock_lock);

		if (!gs)
		gs = ERR_PTR(-EINVAL);
		}

		return gs;
		}

Admin message