diff options
| author | Jesse Gross <jesse@nicira.com> | 2014-12-16 18:25:32 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-12-18 12:38:13 -0500 |
| commit | 12069401d895ff84076a50189ca842c0696b84b2 (patch) | |
| tree | d93c1ec4635a9d2d64fff54d376e40da3a72e13e /net | |
| parent | 7ed767f73192d6daf673c6d885cd02d5f280ac1f (diff) | |
| download | linux-12069401d895ff84076a50189ca842c0696b84b2.tar.gz linux-12069401d895ff84076a50189ca842c0696b84b2.tar.bz2 linux-12069401d895ff84076a50189ca842c0696b84b2.zip | |
geneve: Fix races between socket add and release.
Currently, searching for a socket to add a reference to is not
synchronized with deletion of sockets. This can result in use
after free if there is another operation that is removing a
socket at the same time. Solving this requires both holding the
appropriate lock and checking the refcount to ensure that it
has not already hit zero.
Inspired by a related (but not exactly the same) issue in the
VXLAN driver.
Fixes: 0b5e8b8e ("net: Add Geneve tunneling protocol driver")
CC: Andy Zhou <azhou@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/geneve.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c index 5a47188b01e9..95e47c97585e 100644 --- a/net/ipv4/geneve.c +++ b/net/ipv4/geneve.c @@ -296,6 +296,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port, geneve_rcv_t *rcv, void *data, bool no_share, bool ipv6) { + struct geneve_net *gn = net_generic(net, geneve_net_id); struct geneve_sock *gs; gs = geneve_socket_create(net, port, rcv, data, ipv6); @@ -305,15 +306,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port, if (no_share) /* Return error if sharing is not allowed. */ return ERR_PTR(-EINVAL); + spin_lock(&gn->sock_lock); gs = geneve_find_sock(net, port); - if (gs) { - if (gs->rcv == rcv) - atomic_inc(&gs->refcnt); - else + if (gs && ((gs->rcv != rcv) || + !atomic_add_unless(&gs->refcnt, 1, 0))) gs = ERR_PTR(-EBUSY); - } else { + spin_unlock(&gn->sock_lock); + + if (!gs) gs = ERR_PTR(-EINVAL); - } return gs; } |