vsock: fix the race conditions in multi-transport support
There are multiple similar bugs implicitly introduced by the commit c0cfa2d8 ("vsock: add multi-transports support") and commit 6a2c0962 ("vsock: prevent transport modules unloading"). The bug pattern: [1] vsock_sock.transport pointer is copied to a local variable, [2] lock_sock() is called, [3] the local variable is used. VSOCK multi-transport support introduced the race condition: vsock_sock.transport value may change between [1] and [2]. Let's copy vsock_sock.transport pointer to local variables after the lock_sock() call. Fixes: c0cfa2d8 ("vsock: add multi-transports support") Signed-off-by:Alexander Popov <alex.popov@linux.com> Reviewed-by:
Stefano Garzarella <sgarzare@redhat.com> Reviewed-by:
Jorgen Hansen <jhansen@vmware.com> Link: https://lore.kernel.org/r/20210201084719.2257066-1-alex.popov@linux.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org>
parent
938e0fcd
Please register or sign in to comment