From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752763AbcERLp2 (ORCPT ); Wed, 18 May 2016 07:45:28 -0400 Received: from mail-db3on0121.outbound.protection.outlook.com ([157.55.234.121]:45745 "EHLO emea01-db3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752533AbcERLp0 (ORCPT ); Wed, 18 May 2016 07:45:26 -0400 Authentication-Results: davemloft.net; dkim=none (message not signed) header.d=none;davemloft.net; dmarc=none action=none header.from=virtuozzo.com; From: Andrey Ryabinin To: "David S. Miller" CC: Hannes Frederic Sowa , Rainer Weikusat , Eric Dumazet , , , Andrey Ryabinin Subject: [PATCH] net: af_unix: protect ->sk_shutdown change with lock_sock() Date: Wed, 18 May 2016 13:14:46 +0300 Message-ID: <1463566486-9123-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM2PR03CA0032.eurprd03.prod.outlook.com (10.160.207.42) To HE1PR0801MB1306.eurprd08.prod.outlook.com (10.167.247.148) X-MS-Office365-Filtering-Correlation-Id: 58d160de-dc39-4cf4-3f31-08d37f05289f X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1306;2:1K8cQ/qLHlWAtxfpodXpPbKWBjEqM56AnOkYbeYezEPEqL6XQEdTwazsVxupG7EXt5Y00S4eR2hKhxe98dehyLMv7wI/M9AXGG6SqO15unUSQSSy2tRKDRaOK4rIB4xnt0XX/2hX6YTlWxYr8oEIXKqGSzo11ceYtQsdLgkqrHuEAp5CtYgDb+DFwwZjImJ8;3:dH6QF2Fn4DTBd8ewpK392CeHcwWKcOWuBGTNujc+VMTpnHetUdgPuKcxsvJQXXFAfZBcmv1wzY78pYZYtxHHDf6Wj4rUmblQPypiDLgoYonsbC1eESrF7v2j+jm6M1sE X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1306; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1306;25:MSDZYGxZLyjid6LxBfnCvqcqIFfUJP9a8EKY4+02B4p1bmeRh1/WIYOZRo/mwM7ram41Vdj2OnJFJQyLViIe/6lx3oh16YbQzdhOHfbyy5tUU2HMqMVPK0XTd6HPaZOvk6/sSOBgxmoYUi/6JawbeMi+yrf8+SJhU31i6+2CXfK4ZFJUbW32LQlNAm8D03AdDdcLhHR1peGN4M1umFsyZ1aUCqBgwlfDwqyCM7y1jnMzF94WXe84LKqfoIRnwIQ/BlVVxd6D62D1XkqHddfWbCcieLqb92joF6DxeKijHSa+O7LqQKtJ3kXA+CpgKzPrkTwQfVb6+VBsA9sX+sRYAU4RGhlxvAYNwVfliIY8NsuEERzerVU500sp2g6ZrTvFDzr5JAtFU7dK45TobT0c1QXBXrwvZzDU5rao3vQxZo6p54+BnRFa3m5yAVJCbBBv8+O1kxpmhJVoBh1y51a+sVIg3rSo20rHXi9TqHLeyfdx1WfzzeleGj5rhNdzezTC1XykrjiCtu++kVsXLX0RKvsLQkZsbT/yfxexXdMK3P/8kDqsPhmgvu+V8jfxqPQlgeaYdEBEqkYou4kfzprFKIUs8U3V3lZ+zWBamQBg65RR35wQLVujPD0+5o+5XpWT4/n1/7guu1+eThIg41W7yOof1iYyv9f4iLpChqjreXtpf8Hgqc1KO4vNuXzeRmPp7PsPlLkXJdXcz/PYXfMZPFMcxiKvp2UU90fqZ6W8zF2s2+kWAdi9LvKHClErjA3tgkoiOHWcdE+Kh9x4sc8keA== X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041072)(6043046);SRVR:HE1PR0801MB1306;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0801MB1306; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1306;4:mjlJ4GtrxuYpJU3wjMWWLFJNHTv5dXXrx8RHbwgCIssUva/zWg4PAjU5h6z0tYARyxitSvtZAaejyxByBKMIm8y/jAeM2J2L7OWZ+xWxqpH6jUWe0gkgzVlT5LVQiw41xRzB9Hkde95sSc7yVx+N6v+6N+VZMHC8OJMF8qwf5uf7tJ5Gpb8bYCPYSwAjLXt+nF/Z+tADAznIKVLK9XGpcyVdjZfxYatMBExXZu7ZQ7hyYNe0bw18QmER77yBRZ57Lb6GHmLeLaeeo1KQiziTgrdLI83+bP5NwgJZJHbmTWK70rppzS6DQoTCLblFGhIZIPdL7DN2zJcvNE/kggUjuSYehNrour7KJw4JMNPcUSkVx3vltlfluYkvJ+Hn5i8Y2gTO6T2llbUSly44x8OF+TZXdW5DSXxsdmRitr6QuJw= X-Forefront-PRVS: 0946DC87A1 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(92566002)(66066001)(586003)(6116002)(3846002)(33646002)(5008740100001)(77096005)(229853001)(48376002)(53416004)(19580395003)(19580405001)(76506005)(50466002)(81166006)(42186005)(8676002)(5004730100002)(4001430100002)(110136002)(107886002)(86362001)(50226002)(189998001)(5003940100001)(2906002)(47776003)(50986999)(36756003);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0801MB1306;H:localhost.sw.ru;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1306;23:KwuQfL7zyj5ti9BrMZc/jPTP1zwoXxFa7TRNr9mV9DP9ENNDooKLZ28E4kXBUfiSV2E3v9CBrWA+sZMc1Y524g3II8zm9yWZOroq5mfbtcZMQR7CwfL0hNUGdl62jejbPUHw82x2kY6N9CegjadLrKs3Ty5dUlZo6GlDiNB9YtE8O9nCwwYmsBwoy5LXr1re0nGzovMOQpnFSNwCWewHLdivVq6LoRvxCdjasDbFHRHwKyYcnGIxCqAetjRdgbFRPZ0m6fTLp75wDPJiikNVM7kLk8SzN9BzS2r5ZERNoo8/AD7fUqYQUEzMvZnjfF5r584JGn3L6gQ3bDQXe3gsLgXrgmAHCxapKoWCuuwrG9KOfNhS/dwLeiL3OKcfH0ocBrrHo84U8mRXdeC80ABBHQV3copf9FVyRnKCv5nNc4WI9zvCrnP3qr+Oo5FPBJFP4bz3WVAWN2I9iI70yNNfvdIZM501SRdmiv0PuSP63axSv+3lrOeVoNiClD5ZfQL7cv8NksCiWMQ7bpLqgpHE7RlXYJvg6pluVJxlv09wjWFLT1n/4pumWwaEVO2JUmjr6mB724pYb0/rwCUNxMGmy033BkWK8m3LHnnn1sKfShjnqSx1o6d7UjXsHOa1jfzB8vqh7/tcDWmooWZ6vJ80/5t7Zd1oqb1WUr9ZsNutn0a0ThOBvUSYbmVgVncOUQuElJK6DEBEnncyKbDWguvJPJnGTJYUCxy5N/w6NrOJastcHoj41UdV3/jGqEcVt9eGK8Xz+RjLATPnMcyDKCoC/WbZOrUjx98xu/E632rCYaq3XJH56RypWIf35vcMEQF7hXw/Qq9+qEXWYyIMv8uzihq4Qe2HtQ2F570i1DTkZt2evFaP9T/1HGTp92Hi1wssCQm6CDXtO0CeQcxvzUwz7w== X-Microsoft-Exchange-Diagnostics: 1;HE1PR0801MB1306;5:WlMcbgSIllPPX1+QSJgqQVVSTEZbv5omZ6VLnDjSmtHrdbe4GAr5rTkXfX2a+b517TPDza4ffY/cbj5+GcxCgG9ARjG1DxDZ0BwxUwa5RdDq/bXhVUOgVa2KFzc0MqLanQZJ7JuIKUqTtCznaD+cuw==;24:vCxpkoQ5K1xUcIxcGzEqaMi8TGrnOkxhn6qqVgEh5v6BXAxANzOOXNQ6D7GWkKmSHtIE/g1GCmL1xmgTjZCY44UPHxThtzSMNfncmy551Cw=;7:GnWd5rjXuCEAwJNgtw5rTWFhc70Pdntksl8kHNOLz7sWxf2ofev09Z5yyYSBrI6X24fOpHkGkX2mV5t0aTy4dEVd7bAyVle+oCXia9LY3dsIvF2bTJw09drT9V5plSh4jXSq8Xx/eWgcmzAK+hIWJwZgdBG2f/6pS44piBs/tmkyZBeTJiRtyfYasuX9yxVA;20:M9CeANIDKJpWuFH+5Lro8isGfOHgT13kqVsUk0yKbx9/XRFEhagMYT4w0uCeNZYHFK3UB54730gxxl4Ci8SPs4f2WZyl+CysbhykROjMTpmEVwKy7Sx4TJ//WdUOSMb5LvSovO0KkxOi59eYNnKzBEAKgit00cLuN6dtgvK3VMM= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 May 2016 10:14:11.5273 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB1306 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ->sk_shutdown bits share one bitfield with some other bits in sock struct, such as ->sk_no_check_[r,t]x, ->sk_userlocks ... sock_setsockopt() may write to these bits, while holding the socket lock. In case of AF_UNIX sockets, we change ->sk_shutdown bits while holding only unix_state_lock(). So concurrent setsockopt() and shutdown() may lead to corrupting these bits. Fix that by protecting writes to ->sk_shutdown with lock_sock() Signed-off-by: Andrey Ryabinin --- net/unix/af_unix.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 80aa6a3..7586a4e 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -518,6 +518,7 @@ static void unix_release_sock(struct sock *sk, int embrion) unix_remove_socket(sk); /* Clear state */ + lock_sock(sk); unix_state_lock(sk); sock_orphan(sk); sk->sk_shutdown = SHUTDOWN_MASK; @@ -527,6 +528,7 @@ static void unix_release_sock(struct sock *sk, int embrion) state = sk->sk_state; sk->sk_state = TCP_CLOSE; unix_state_unlock(sk); + release_sock(sk); wake_up_interruptible_all(&u->peer_wait); @@ -534,12 +536,14 @@ static void unix_release_sock(struct sock *sk, int embrion) if (skpair != NULL) { if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) { + lock_sock(skpair); unix_state_lock(skpair); /* No more writes */ skpair->sk_shutdown = SHUTDOWN_MASK; if (!skb_queue_empty(&sk->sk_receive_queue) || embrion) skpair->sk_err = ECONNRESET; unix_state_unlock(skpair); + release_sock(skpair); skpair->sk_state_change(skpair); sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP); } @@ -2547,12 +2551,14 @@ static int unix_shutdown(struct socket *sock, int mode) */ ++mode; + lock_sock(sk); unix_state_lock(sk); sk->sk_shutdown |= mode; other = unix_peer(sk); if (other) sock_hold(other); unix_state_unlock(sk); + release_sock(sk); sk->sk_state_change(sk); if (other && @@ -2564,9 +2570,12 @@ static int unix_shutdown(struct socket *sock, int mode) peer_mode |= SEND_SHUTDOWN; if (mode&SEND_SHUTDOWN) peer_mode |= RCV_SHUTDOWN; + + lock_sock(other); unix_state_lock(other); other->sk_shutdown |= peer_mode; unix_state_unlock(other); + release_sock(other); other->sk_state_change(other); if (peer_mode == SHUTDOWN_MASK) sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP); -- 2.7.3