Unverified Commit 809b0c8d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9328 CVE-2024-38596 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/QTFSFVE2JGO3WJSP7A6EJNMKFOW647ZB/ 
CVE-2024-38596

Breno Leitao (1):
  af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

Kuniyuki Iwashima (2):
  af_unix: Fix data races around sk->sk_shutdown.
  af_unix: Fix data-races around sk->sk_shutdown.


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IA6SCO 
 
Link:https://gitee.com/openeuler/kernel/pulls/9328

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 7cdd9762 d64d4e36

net/core/sock.c

+2 −2
Original line number Diff line number Diff line
@@ -2300,7 +2300,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo) 
		prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);

		if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf))

			break;

		if (sk->sk_shutdown & SEND_SHUTDOWN)

		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)

			break;

		if (sk->sk_err)

			break;
@@ -2330,7 +2330,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 
			goto failure;



		err = -EPIPE;

		if (sk->sk_shutdown & SEND_SHUTDOWN)

		if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)

			goto failure;



		if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf))

net/unix/af_unix.c

+13 −9
Original line number Diff line number Diff line
@@ -579,7 +579,7 @@ static void unix_release_sock(struct sock *sk, int embrion) 
	/* Clear state */

	unix_state_lock(sk);

	sock_orphan(sk);

	sk->sk_shutdown = SHUTDOWN_MASK;

	WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);

	path	     = u->path;

	u->path.dentry = NULL;

	u->path.mnt = NULL;
@@ -597,7 +597,7 @@ static void unix_release_sock(struct sock *sk, int embrion) 
		if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {

			unix_state_lock(skpair);

			/* No more writes */

			skpair->sk_shutdown = SHUTDOWN_MASK;

			WRITE_ONCE(skpair->sk_shutdown, SHUTDOWN_MASK);

			if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)

				skpair->sk_err = ECONNRESET;

			unix_state_unlock(skpair);
@@ -2028,7 +2028,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, 
			goto out_err;

	}



	if (sk->sk_shutdown & SEND_SHUTDOWN)

	if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)

		goto pipe_err;



	while (sent < len) {
@@ -2688,7 +2688,7 @@ static int unix_shutdown(struct socket *sock, int mode) 
	++mode;



	unix_state_lock(sk);

	sk->sk_shutdown |= mode;

	WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | mode);

	other = unix_peer(sk);

	if (other)

		sock_hold(other);
@@ -2705,7 +2705,7 @@ static int unix_shutdown(struct socket *sock, int mode) 
		if (mode&SEND_SHUTDOWN)

			peer_mode |= RCV_SHUTDOWN;

		unix_state_lock(other);

		other->sk_shutdown |= peer_mode;

		WRITE_ONCE(other->sk_shutdown, other->sk_shutdown | peer_mode);

		unix_state_unlock(other);

		other->sk_state_change(other);

		if (peer_mode == SHUTDOWN_MASK)
@@ -2824,16 +2824,18 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa 
{

	struct sock *sk = sock->sk;

	__poll_t mask;

	u8 shutdown;



	sock_poll_wait(file, sock, wait);

	mask = 0;

	shutdown = READ_ONCE(sk->sk_shutdown);



	/* exceptional events? */

	if (sk->sk_err)

		mask |= EPOLLERR;

	if (sk->sk_shutdown == SHUTDOWN_MASK)

	if (shutdown == SHUTDOWN_MASK)

		mask |= EPOLLHUP;

	if (sk->sk_shutdown & RCV_SHUTDOWN)

	if (shutdown & RCV_SHUTDOWN)

		mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;



	/* readable? */
@@ -2861,18 +2863,20 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock, 
	struct sock *sk = sock->sk, *other;

	unsigned int writable;

	__poll_t mask;

	u8 shutdown;



	sock_poll_wait(file, sock, wait);

	mask = 0;

	shutdown = READ_ONCE(sk->sk_shutdown);



	/* exceptional events? */

	if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))

		mask |= EPOLLERR |

			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);



	if (sk->sk_shutdown & RCV_SHUTDOWN)

	if (shutdown & RCV_SHUTDOWN)

		mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;

	if (sk->sk_shutdown == SHUTDOWN_MASK)

	if (shutdown == SHUTDOWN_MASK)

		mask |= EPOLLHUP;



	/* readable? */