stuartl/linux-stable
1
0
Fork 0
mirror of https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable.git synced 2025-09-14 11:19:08 +10:00
Code Issues Releases Wiki Activity

net: rose: lock the socket in rose_bind()

Browse Source 
[ Upstream commit a1300691ae ]

syzbot reported a soft lockup in rose_loopback_timer(),
with a repro calling bind() from multiple threads.

rose_bind() must lock the socket to avoid this issue.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+7ff41b5215f0c534534e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/67a0f78d.050a0220.d7c5a.00a0.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/20250203170838.3521361-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Eric Dumazet 2025-02-03 17:08:38 +00:00 committed by Greg Kroah-Hartman
parent 4fae092c3c
commit b8bf5c3fb7
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
net/rose/af_rose.c
View File

@ -678,11 +678,9 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
struct net_device *dev; struct net_device *dev;
ax25_address *source; ax25_address *source;
ax25_uid_assoc *user; ax25_uid_assoc *user;
int err = -EINVAL;
int n; int n;
if (!sock_flag(sk, SOCK_ZAPPED))
return -EINVAL;
if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose)) if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
return -EINVAL; return -EINVAL;
@ -695,8 +693,15 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS) if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
return -EINVAL; return -EINVAL;
if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) lock_sock(sk);
return -EADDRNOTAVAIL;
if (!sock_flag(sk, SOCK_ZAPPED))
goto out_release;
err = -EADDRNOTAVAIL;
dev = rose_dev_get(&addr->srose_addr);
if (!dev)
goto out_release;
source = &addr->srose_call; source = &addr->srose_call;
@ -707,7 +712,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
} else { } else {
if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) { if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
dev_put(dev); dev_put(dev);
return -EACCES; err = -EACCES;
goto out_release;
} }
rose->source_call = *source; rose->source_call = *source;
} }
@ -729,8 +735,10 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
rose_insert_socket(sk); rose_insert_socket(sk);
sock_reset_flag(sk, SOCK_ZAPPED); sock_reset_flag(sk, SOCK_ZAPPED);
err = 0;
return 0; out_release:
release_sock(sk);
return err;
} }
static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags) static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)