This is a note to let you know that I've just added the patch titled
geneve: Fix races between socket add and release.
to the 3.18-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
geneve-fix-races-between-socket-add-and-release.patch
and it can be found in the queue-3.18 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Sat Jan 17 18:12:21 PST 2015
From: Jesse Gross <jesse@xxxxxxxxxx>
Date: Tue, 16 Dec 2014 18:25:32 -0800
Subject: geneve: Fix races between socket add and release.
From: Jesse Gross <jesse@xxxxxxxxxx>
[ Upstream commit 12069401d895ff84076a50189ca842c0696b84b2 ]
Currently, searching for a socket to add a reference to is not
synchronized with deletion of sockets. This can result in use
after free if there is another operation that is removing a
socket at the same time. Solving this requires both holding the
appropriate lock and checking the refcount to ensure that it
has not already hit zero.
Inspired by a related (but not exactly the same) issue in the
VXLAN driver.
Fixes: 0b5e8b8e ("net: Add Geneve tunneling protocol driver")
CC: Andy Zhou <azhou@xxxxxxxxxx>
Signed-off-by: Jesse Gross <jesse@xxxxxxxxxx>
Acked-by: Thomas Graf <tgraf@xxxxxxx>
Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/ipv4/geneve.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -302,6 +302,7 @@ struct geneve_sock *geneve_sock_add(stru
geneve_rcv_t *rcv, void *data,
bool no_share, bool ipv6)
{
+ struct geneve_net *gn = net_generic(net, geneve_net_id);
struct geneve_sock *gs;
gs = geneve_socket_create(net, port, rcv, data, ipv6);
@@ -311,15 +312,15 @@ struct geneve_sock *geneve_sock_add(stru
if (no_share) /* Return error if sharing is not allowed. */
return ERR_PTR(-EINVAL);
+ spin_lock(&gn->sock_lock);
gs = geneve_find_sock(net, port);
- if (gs) {
- if (gs->rcv == rcv)
- atomic_inc(&gs->refcnt);
- else
+ if (gs && ((gs->rcv != rcv) ||
+ !atomic_add_unless(&gs->refcnt, 1, 0)))
gs = ERR_PTR(-EBUSY);
- } else {
+ spin_unlock(&gn->sock_lock);
+
+ if (!gs)
gs = ERR_PTR(-EINVAL);
- }
return gs;
}
Patches currently in stable-queue which might be from jesse@xxxxxxxxxx are
queue-3.18/net-generalize-ndo_gso_check-to-ndo_features_check.patch
queue-3.18/geneve-remove-socket-and-offload-handlers-at-destruction.patch
queue-3.18/geneve-fix-races-between-socket-add-and-release.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html