tree b7df0c171290c0cfa3b111a369f7b00e0b5919ba
parent bbe3394dcd24530dd05b2059e7ab7263a07a34c6
author Cong Wang <xiyou.wangcong@gmail.com> 1528403989 -0700
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1533922652 +0000

UPSTREAM: socket: close race condition between sock_close() and sockfs_setattr()

fchownat() doesn't even hold refcnt of fd until it figures out
fd is really needed (otherwise is ignored) and releases it after
it resolves the path. This means sock_close() could race with
sockfs_setattr(), which leads to a NULL pointer dereference
since typically we set sock->sk to NULL in ->release().

As pointed out by Al, this is unique to sockfs. So we can fix this
in socket layer by acquiring inode_lock in sock_close() and
checking against NULL in sockfs_setattr().

sock_release() is called in many places, only the sock_close()
path matters here. And fortunately, this should not affect normal
sock_close() as it is only called when the last fd refcnt is gone.
It only affects sock_close() with a parallel sockfs_setattr() in
progress, which is not common.

Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
Reported-by: shankarapailoor <shankarapailoor@gmail.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 6d8c50dcb029872b298eea68cc6209c866fd3e14)

BUG=chromium:871731
TEST=Run POC

Change-Id: Ied1e0561ab0c300ef329919457c5b09451cf7645
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1165495
Reviewed-by: Zubin Mithra <zsm@chromium.org>
(cherry picked from commit b5977f05bff49451922de9e7ddd19679e61bdb57)
Reviewed-on: https://chromium-review.googlesource.com/1169983
Trybot-Ready: Edward Jee <edjee@google.com>
Commit-Queue: Edward Jee <edjee@google.com>
Tested-by: Edward Jee <edjee@google.com>