• Cong Wang's avatar
    socket: close race condition between sock_close() and sockfs_setattr() · 6d8c50dc
    Cong Wang authored
    fchownat() doesn't even hold refcnt of fd until it figures out
    fd is really needed (otherwise is ignored) and releases it after
    it resolves the path. This means sock_close() could race with
    sockfs_setattr(), which leads to a NULL pointer dereference
    since typically we set sock->sk to NULL in ->release().
    
    As pointed out by Al, this is unique to sockfs. So we can fix this
    in socket layer by acquiring inode_lock in sock_close() and
    checking against NULL in sockfs_setattr().
    
    sock_release() is called in many places, only the sock_close()
    path matters here. And fortunately, this should not affect normal
    sock_close() as it is only called when the last fd refcnt is gone.
    It only affects sock_close() with a parallel sockfs_setattr() in
    progress, which is not common.
    
    Fixes: 86741ec2 ("net: core: Add a UID field to struct sock.")
    Reported-by: default avatarshankarapailoor <[email protected]>
    Cc: Tetsuo Handa <[email protected]>
    Cc: Lorenzo Colitti <[email protected]>
    Cc: Al Viro <[email protected]>
    Signed-off-by: default avatarCong Wang <[email protected]>
    Signed-off-by: default avatarDavid S. Miller <[email protected]>
    6d8c50dc
socket.c 84.5 KB