[NET]: Fix sk->sk_filter field access

Function sk_filter() is called from tcp_v{4,6}_rcv() functions with arg
needlock = 0, while socket is not locked at that moment. In order to avoid
this and similar issues in the future, use rcu for sk->sk_filter field read
protection.

Signed-off-by: Dmitry Mishin <dim@openvz.org>
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>

2 files changed, 24 insertions, 23 deletions

diff --git a/include/linux/filter.h b/include/linux/filter.h
index c6cb8f095088..91b2e3b9251e 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -25,10 +25,10 @@
  
 struct sock_filter      /* Filter block */
 {
-        __u16   code;   /* Actual filter code */
-        __u8    jt;     /* Jump true */
-        __u8    jf;     /* Jump false */
-        __u32   k;      /* Generic multiuse field */
+        __u16   code;   /* Actual filter code */
+        __u8    jt;     /* Jump true */
+        __u8    jf;     /* Jump false */
+        __u32   k;      /* Generic multiuse field */
 };
 
 struct sock_fprog       /* Required for SO_ATTACH_FILTER. */
@@ -41,8 +41,9 @@ struct sock_fprog	/* Required for SO_ATTACH_FILTER. */
 struct sk_filter
 {
         atomic_t                refcnt;
-        unsigned int            len;    /* Number of filter blocks */
-        struct sock_filter      insns[0];
+        unsigned int            len;    /* Number of filter blocks */
+        struct rcu_head         rcu;
+        struct sock_filter      insns[0];
 };
 
 static inline unsigned int sk_filter_len(struct sk_filter *fp)
diff --git a/include/net/sock.h b/include/net/sock.h
index 337ebec84c70..edd4d73ce7f5 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -862,30 +862,24 @@ extern void sock_init_data(struct socket *sock, struct sock *sk);
  *
  */
 
-static inline int sk_filter(struct sock *sk, struct sk_buff *skb, int needlock)
+static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 {
         int err;
+        struct sk_filter *filter;
         
         err = security_sock_rcv_skb(sk, skb);
         if (err)
                 return err;
         
-        if (sk->sk_filter) {
-                struct sk_filter *filter;
-                
-                if (needlock)
-                        bh_lock_sock(sk);
-                
-                filter = sk->sk_filter;
-                if (filter) {
-                        unsigned int pkt_len = sk_run_filter(skb, filter->insns,
-                                                             filter->len);
-                        err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
-                }
-
-                if (needlock)
-                        bh_unlock_sock(sk);
+        rcu_read_lock_bh();
+        filter = sk->sk_filter;
+        if (filter) {
+                unsigned int pkt_len = sk_run_filter(skb, filter->insns,
+                                filter->len);
+                err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
         }
+        rcu_read_unlock_bh();
+
         return err;
 }
 
@@ -897,6 +891,12 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb, int needlock)
  *      Remove a filter from a socket and release its resources.
  */
  
+static inline void sk_filter_rcu_free(struct rcu_head *rcu)
+{
+        struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
+        kfree(fp);
+}
+
 static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
 {
         unsigned int size = sk_filter_len(fp);
@@ -904,7 +904,7 @@ static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
         atomic_sub(size, &sk->sk_omem_alloc);
 
         if (atomic_dec_and_test(&fp->refcnt))
-                kfree(fp);
+                call_rcu_bh(&fp->rcu, sk_filter_rcu_free);
 }
 
 static inline void sk_filter_charge(struct sock *sk, struct sk_filter *fp)