From patchwork Wed May 18 14:36:32 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jacek Luczak X-Patchwork-Id: 96174 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E1C68B6F69 for ; Thu, 19 May 2011 00:36:38 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757254Ab1EROge (ORCPT ); Wed, 18 May 2011 10:36:34 -0400 Received: from mail-pw0-f46.google.com ([209.85.160.46]:45039 "EHLO mail-pw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757184Ab1EROgd (ORCPT ); Wed, 18 May 2011 10:36:33 -0400 Received: by pwi15 with SMTP id 15so772845pwi.19 for ; Wed, 18 May 2011 07:36:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=Xb+tYpdt+C5derol+zhfPE8DefkSeRgQgW3tbu3GXa8=; b=BCtXs4SKzXQ1TOm/F2qTF94dyBz4YkUi4sfZtp9DQi+Ut2SQVZrVxyw5T+xs52y7mO tx29BZtyAZVlHBDYCtJdz+mFnAMpB5/Iq82Xu+LJ1BSjFx7ucTvqXWubbMW9P9T+RMz4 iKo90xwoqhkUYZV0ozJWAJiTIZeK8dLRtyuk0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=SF+sElf5HkqrcZJOclJETRSlOr0aoziwKVMTSTatq4AQoVWlMLG1rMCOycSUsWel/Y 8afT3HL0EFZ8yDU5DMghHDuxS2AHPpMWvl0b0A9zu8rCuQyhD2BAdSQx0/9elYbzL/s3 dxhg66q3QaUPeqetiLHxrCNhnhykOdSgrMwYU= MIME-Version: 1.0 Received: by 10.68.17.198 with SMTP id q6mr2722743pbd.287.1305729392706; Wed, 18 May 2011 07:36:32 -0700 (PDT) Received: by 10.68.48.199 with HTTP; Wed, 18 May 2011 07:36:32 -0700 (PDT) Date: Wed, 18 May 2011 16:36:32 +0200 Message-ID: Subject: PATCH] SCTP: fix race between sctp_bind_addr_free() and sctp_bind_addr_conflict() From: Jacek Luczak To: netdev@vger.kernel.org Cc: Vladislav Yasevich , Eric Dumazet Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org During the sctp_close() call, we do not use rcu primitives to destroy the address list attached to the endpoint. At the same time, we do the removal of addresses from this list before attempting to remove the socket from the port hash As a result, it is possible for another process to find the socket in the port hash that is in the process of being closed. It then proceeds to traverse the address list to find the conflict, only to have that address list suddenly disappear without rcu() critical section. Fix issue by closing address list removal inside RCU critical section. Race can result in a kernel crash with general protection fault or kernel NULL pointer dereference: kernel: general protection fault: 0000 [#1] SMP kernel: RIP: 0010:[] [] sctp_bind_addr_conflict+0x64/0x82 [sctp] kernel: Call Trace: kernel: [] ? sctp_get_port_local+0x17b/0x2a3 [sctp] kernel: [] ? sctp_bind_addr_match+0x33/0x68 [sctp] kernel: [] ? sctp_do_bind+0xd3/0x141 [sctp] kernel: [] ? sctp_bindx_add+0x4d/0x8e [sctp] kernel: [] ? sctp_setsockopt_bindx+0x112/0x4a4 [sctp] kernel: [] ? generic_file_aio_write+0x7f/0x9b kernel: [] ? sctp_setsockopt+0x14f/0xfee [sctp] kernel: [] ? do_sync_write+0xab/0xeb kernel: [] ? fsnotify+0x239/0x282 kernel: [] ? alloc_file+0x18/0xb1 kernel: [] ? compat_sys_setsockopt+0x1a5/0x1d9 kernel: [] ? compat_sys_socketcall+0x143/0x1a4 kernel: [] ? sysenter_dispatch+0x7/0x32 Signed-off-by: Jacek Luczak Acked-by: Vlad Yasevich CC: Eric Dumazet --- net/sctp/bind_addr.c | 10 ++++------ 1 files changed, 4 insertions(+), 6 deletions(-) } diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c index faf71d1..6150ac5 100644 --- a/net/sctp/bind_addr.c +++ b/net/sctp/bind_addr.c @@ -140,14 +140,12 @@ void sctp_bind_addr_init(struct sctp_bind_addr *bp, __u16 port) /* Dispose of the address list. */ static void sctp_bind_addr_clean(struct sctp_bind_addr *bp) { - struct sctp_sockaddr_entry *addr; - struct list_head *pos, *temp; + struct sctp_sockaddr_entry *addr, *temp; /* Empty the bind address list. */ - list_for_each_safe(pos, temp, &bp->address_list) { - addr = list_entry(pos, struct sctp_sockaddr_entry, list); - list_del(pos); - kfree(addr); + list_for_each_entry_safe(addr, temp, &bp->address_list, list) { + list_del_rcu(&addr->list); + call_rcu(&addr->rcu, sctp_local_addr_free); SCTP_DBG_OBJCNT_DEC(addr); }