android_kernel_samsung_msm8976/net
Eric Biggers ca794923f3 net: socket: set sock->sk to NULL after calling proto_ops::release()
[ Upstream commit ff7b11aa481f682e0e9711abfeb7d03f5cd612bf ]

Commit 9060cb719e61 ("net: crypto set sk to NULL when af_alg_release.")
fixed a use-after-free in sockfs_setattr() when an AF_ALG socket is
closed concurrently with fchownat().  However, it ignored that many
other proto_ops::release() methods don't set sock->sk to NULL and
therefore allow the same use-after-free:

    - base_sock_release
    - bnep_sock_release
    - cmtp_sock_release
    - data_sock_release
    - dn_release
    - hci_sock_release
    - hidp_sock_release
    - iucv_sock_release
    - l2cap_sock_release
    - llcp_sock_release
    - llc_ui_release
    - rawsock_release
    - rfcomm_sock_release
    - sco_sock_release
    - svc_release
    - vcc_release
    - x25_release

Rather than fixing all these and relying on every socket type to get
this right forever, just make __sock_release() set sock->sk to NULL
itself after calling proto_ops::release().

Reproducer that produces the KASAN splat when any of these socket types
are configured into the kernel:

    #include <pthread.h>
    #include <stdlib.h>
    #include <sys/socket.h>
    #include <unistd.h>

    pthread_t t;
    volatile int fd;

    void *close_thread(void *arg)
    {
        for (;;) {
            usleep(rand() % 100);
            close(fd);
        }
    }

    int main()
    {
        pthread_create(&t, NULL, close_thread, NULL);
        for (;;) {
            fd = socket(rand() % 50, rand() % 11, 0);
            fchownat(fd, "", 1000, 1000, 0x1000);
            close(fd);
        }
    }

Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-27 22:09:14 +02:00
..
9p 9p: forgetting to cancel request on interrupted zero-copy RPC 2015-08-03 09:29:47 -07:00
802
8021q
appletalk
atm
ax25 Import latest Samsung release 2017-04-18 03:43:52 +02:00
batman-adv batman-adv: Fix broadcast/ogm queue limit on a removed interface 2016-06-07 10:42:53 +02:00
bluetooth Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer 2019-07-27 22:08:55 +02:00
bridge bridge: netfilter: orphan skb before invoking ip netfilter hooks 2019-07-27 22:07:48 +02:00
caif net/unix: sk_socket can disappear when state is unlocked 2015-09-16 18:20:18 +05:30
can
ceph libceph: introduce ceph_crypt() for in-place en/decryption 2017-04-22 23:02:50 +02:00
core net/neighbour: fix crash at dumping device-agnostic proxy entries 2019-07-27 22:08:23 +02:00
dcb
dccp net/dccp: fix use after free in tw_timer_handler() 2019-07-27 22:08:37 +02:00
decnet Import latest Samsung release 2017-04-18 03:43:52 +02:00
dns_resolver dns_resolver: Do not accept domain names longer than 255 chars 2019-07-27 22:07:53 +02:00
dsa
ethernet
ieee802154
ipc_router net: ipc_router: Initialize the sockaddr in recvmsg() handler 2019-07-27 22:08:44 +02:00
ipv4 ipv4: igmp: guard against silly MTU values 2019-07-27 22:08:52 +02:00
ipv6 ipv6: mcast: better catch silly mtu values 2019-07-27 22:08:52 +02:00
ipx ipx: call ipxitf_put() in ioctl error path 2018-01-21 21:05:49 -08:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-04-22 23:02:49 +02:00
iucv
key net: af_key: fix sleeping under rcu 2019-07-27 22:08:21 +02:00
l2tp l2tp: fix reading optional fields of L2TPv3 2019-07-27 22:05:58 +02:00
lapb
llc llc: do not use sk_eat_skb() 2019-07-27 22:08:34 +02:00
mac80211 mac80211: use constant time comparison with keys 2019-07-27 21:45:47 +02:00
mac802154
netfilter netfilter: xt_IDLETIMER: add sysfs filename checking routine 2019-07-27 22:08:35 +02:00
netlabel netlabel: add address family checks to netlbl_{sock,req}_delattr() 2019-07-27 21:41:59 +02:00
netlink net: Fix permission check in netlink_connect() 2019-07-27 22:08:32 +02:00
netrom
nfc NFC: llcp: Limit size of SDP URI 2019-07-27 21:51:24 +02:00
openvswitch
packet packets: Always register packet sk in the same order 2019-07-27 22:09:00 +02:00
phonet This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
rds This is the 3.10.99 stable release 2017-04-18 17:17:46 +02:00
rfkill net: rfkill: Do not ignore errors from regulator_enable() 2019-07-27 21:42:01 +02:00
rmnet_data net: rmnet_data: Change the log level for unknown IOCTL's 2019-07-27 21:51:01 +02:00
rose
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2019-07-27 21:44:13 +02:00
sched net: Prevent invalid access to skb->prev in __qdisc_drop_all 2019-07-27 21:53:24 +02:00
sctp sctp: fix a type cast warnings that causes a_rwnd gets the wrong value 2019-07-27 21:45:39 +02:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
tipc net/tipc: initialize security state for new connection socket 2015-10-01 12:07:35 +02:00
unix net/unix: don't show information about sockets from other namespaces 2019-07-27 21:45:50 +02:00
vmw_vsock VSOCK: do not disconnect socket when peer has shutdown SEND only 2016-06-07 10:42:54 +02:00
wimax
wireless cfg80211: size various nl80211 messages correctly 2019-07-27 22:08:58 +02:00
x25 net: fix a kernel infoleak in x25 module 2016-06-07 10:42:54 +02:00
xfrm xfrm: Fix bucket count reported to userspace 2019-07-27 22:08:35 +02:00
activity_stats.c
compat.c net: support compat 64-bit time in {s,g}etsockopt 2019-07-27 21:49:09 +02:00
Kconfig
Makefile
nonet.c
socket.c net: socket: set sock->sk to NULL after calling proto_ops::release() 2019-07-27 22:09:14 +02:00
sysctl_net.c