diff options
| author | Eric Dumazet <edumazet@google.com> | 2021-09-30 00:57:50 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-09-30 15:18:40 +0200 |
| commit | 35306eb23814444bd4021f8a1c3047d3cb0c8b2b (patch) | |
| tree | f01ff49d4c08b6e5465f1ad535264518d1885bdc /include | |
| parent | net: stmmac: fix EEE init issue when paired with EEE capable PHYs (diff) | |
| download | linux-35306eb23814444bd4021f8a1c3047d3cb0c8b2b.tar.xz linux-35306eb23814444bd4021f8a1c3047d3cb0c8b2b.zip | |
af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations
are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
In order to fix this issue, this patch adds a new spinlock that needs
to be used whenever these fields are read or written.
Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently
reading sk->sk_peer_pid which makes no sense, as this field
is only possibly set by AF_UNIX sockets.
We will have to clean this in a separate patch.
This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback"
or implementing what was truly expected.
Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/sock.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/net/sock.h b/include/net/sock.h index dc3f8169312e..ae929e21a376 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -488,8 +488,10 @@ struct sock { u8 sk_prefer_busy_poll; u16 sk_busy_poll_budget; #endif + spinlock_t sk_peer_lock; struct pid *sk_peer_pid; const struct cred *sk_peer_cred; + long sk_rcvtimeo; ktime_t sk_stamp; #if BITS_PER_LONG==32 |