Patch "tipc: add an extra conn_get in tipc_conn_alloc" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tipc: add an extra conn_get in tipc_conn_alloc

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tipc-add-an-extra-conn_get-in-tipc_conn_alloc.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9ac84b6e2d748f2d6c285c7e9d2d71c174590777
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Fri Nov 18 16:45:01 2022 -0500

    tipc: add an extra conn_get in tipc_conn_alloc
    
    [ Upstream commit a7b42969d63f47320853a802efd879fbdc4e010e ]
    
    One extra conn_get() is needed in tipc_conn_alloc(), as after
    tipc_conn_alloc() is called, tipc_conn_close() may free this
    con before deferencing it in tipc_topsrv_accept():
    
       tipc_conn_alloc();
       newsk = newsock->sk;
                                     <---- tipc_conn_close();
       write_lock_bh(&sk->sk_callback_lock);
       newsk->sk_data_ready = tipc_conn_data_ready;
    
    Then an uaf issue can be triggered:
    
      BUG: KASAN: use-after-free in tipc_topsrv_accept+0x1e7/0x370 [tipc]
      Call Trace:
       <TASK>
       dump_stack_lvl+0x33/0x46
       print_report+0x178/0x4b0
       kasan_report+0x8c/0x100
       kasan_check_range+0x179/0x1e0
       tipc_topsrv_accept+0x1e7/0x370 [tipc]
       process_one_work+0x6a3/0x1030
       worker_thread+0x8a/0xdf0
    
    This patch fixes it by holding it in tipc_conn_alloc(), then after
    all accessing in tipc_topsrv_accept() releasing it. Note when does
    this in tipc_topsrv_kern_subscr(), as tipc_conn_rcv_sub() returns
    0 or -1 only, we don't need to check for "> 0".
    
    Fixes: c5fa7b3cf3cb ("tipc: introduce new TIPC server infrastructure")
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Acked-by: Jon Maloy <jmaloy@xxxxxxxxxx>
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c
index 532343c7788a..88e8e8d69b60 100644
--- a/net/tipc/topsrv.c
+++ b/net/tipc/topsrv.c
@@ -207,6 +207,7 @@ static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s, struct socket *s
 	set_bit(CF_CONNECTED, &con->flags);
 	con->server = s;
 	con->sock = sock;
+	conn_get(con);
 	spin_unlock_bh(&s->idr_lock);
 
 	return con;
@@ -484,6 +485,7 @@ static void tipc_topsrv_accept(struct work_struct *work)
 
 		/* Wake up receive process in case of 'SYN+' message */
 		newsk->sk_data_ready(newsk);
+		conn_put(con);
 	}
 }
 
@@ -583,10 +585,11 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower,
 
 	*conid = con->conid;
 	rc = tipc_conn_rcv_sub(tipc_topsrv(net), con, &sub);
-	if (rc >= 0)
-		return true;
+	if (rc)
+		conn_put(con);
+
 	conn_put(con);
-	return false;
+	return !rc;
 }
 
 void tipc_topsrv_kern_unsubscr(struct net *net, int conid)