On Thu, Oct 07, 2021 at 07:05:36PM +0200, Jann Horn wrote:
> From: Eric Dumazet <edumazet@xxxxxxxxxx>
>
> [ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]
>
> Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations
> are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
>
> In order to fix this issue, this patch adds a new spinlock that needs
> to be used whenever these fields are read or written.
>
> Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently
> reading sk->sk_peer_pid which makes no sense, as this field
> is only possibly set by AF_UNIX sockets.
> We will have to clean this in a separate patch.
> This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback"
> or implementing what was truly expected.
>
> Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.")
> Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
> Reported-by: Jann Horn <jannh@xxxxxxxxxx>
> Cc: Eric W. Biederman <ebiederm@xxxxxxxxxxxx>
> Cc: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
> Cc: Marcel Holtmann <marcel@xxxxxxxxxxxx>
> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
> [backport note: 4.4 and 4.9 don't have SO_PEERGROUPS, only SO_PEERCRED]
> [backport note: got rid of sk_get_peer_cred(), no users in 4.4/4.9]
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
> ---
> include/net/sock.h | 2 ++
> net/core/sock.c | 12 +++++++++---
> net/unix/af_unix.c | 34 ++++++++++++++++++++++++++++------
> 3 files changed, 39 insertions(+), 9 deletions(-)
Thanks, both now queued up.
greg k-h
