• Marcelo Leitner's avatar
    Fix race condition between vxlan_sock_add and vxlan_sock_release · 00c83b01
    Marcelo Leitner authored
    Currently, when trying to reuse a socket, vxlan_sock_add will grab
    vn->sock_lock, locate a reusable socket, inc refcount and release
    vn->sock_lock.
    
    But vxlan_sock_release() will first decrement refcount, and then grab
    that lock. refcnt operations are atomic but as currently we have
    deferred works which hold vs->refcnt each, this might happen, leading to
    a use after free (specially after vxlan_igmp_leave):
    
      CPU 1                            CPU 2
    
    deferred work                    vxlan_sock_add
      ...                              ...
                                       spin_lock(&vn->sock_lock)
                                       vs = vxlan_find_sock();
      vxlan_sock_release
        dec vs->refcnt, reaches 0
        spin_lock(&vn->sock_lock)
                                       vxlan_sock_hold(vs), refcnt=1
                                       spin_unlock(&vn->sock_lock)
        hlist_del_rcu(&vs->hlist);
        vxlan_notify_del_rx_port(vs)
        spin_unlock(&vn->sock_lock)
    
    So when we look for a reusable socket, we check if it wasn't freed
    already before reusing it.
    Signed-off-by: default avatarMarcelo Ricardo Leitner <mleitner@redhat.com>
    Fixes: 7c47cedf ("vxlan: move IGMP join/leave to work queue")
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    00c83b01
vxlan.c 71.5 KB