ping: implement proper locking (43a66845) · Commits · 戴 / test

We got a report of yet another bug in ping http://www.openwall.com/lists/oss-security/2017/03/24/6 ->disconnect() is not called with socket lock held. Fix this by acquiring ping rwlock earlier. Thanks to Daniel, Alexander and Andrey for letting us know this problem. Fixes: ("net: ipv4: add IPPROTO_ICMP socket kind") Signed-off-by:

Eric Dumazet <edumazet@google.com> Reported-by:

Daniel Jiang <danieljiang0415@gmail.com> Reported-by:

Solar Designer <solar@openwall.com> Reported-by:

Andrey Konovalov <andreyknvl@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/ping.c

+3 −2

Original line number	Original line	Diff line number	Diff line
	@@ -156,17 +156,18 @@ int ping_hash(struct sock *sk)
	void ping_unhash(struct sock *sk)		void ping_unhash(struct sock *sk)
	{		{
	struct inet_sock *isk = inet_sk(sk);		struct inet_sock *isk = inet_sk(sk);

	pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);		pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num);
	if (sk_hashed(sk)) {
	write_lock_bh(&ping_table.lock);		write_lock_bh(&ping_table.lock);
			if (sk_hashed(sk)) {
	hlist_nulls_del(&sk->sk_nulls_node);		hlist_nulls_del(&sk->sk_nulls_node);
	sk_nulls_node_init(&sk->sk_nulls_node);		sk_nulls_node_init(&sk->sk_nulls_node);
	sock_put(sk);		sock_put(sk);
	isk->inet_num = 0;		isk->inet_num = 0;
	isk->inet_sport = 0;		isk->inet_sport = 0;
	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
	write_unlock_bh(&ping_table.lock);
	}		}
			write_unlock_bh(&ping_table.lock);
	}		}
	EXPORT_SYMBOL_GPL(ping_unhash);		EXPORT_SYMBOL_GPL(ping_unhash);

Admin message