geneve: Fix races between socket add and release.

Currently, searching for a socket to add a reference to is not
synchronized with deletion of sockets. This can result in use
after free if there is another operation that is removing a
socket at the same time. Solving this requires both holding the
appropriate lock and checking the refcount to ensure that it
has not already hit zero.

Inspired by a related (but not exactly the same) issue in the
VXLAN driver.

Fixes: 0b5e8b8e ("net: Add Geneve tunneling protocol driver")
CC: Andy Zhou <azhou@nicira.com>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 7 insertions, 6 deletions

diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index 5a47188b01e9..95e47c97585e 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -296,6 +296,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
                                     geneve_rcv_t *rcv, void *data,
                                     bool no_share, bool ipv6)
 {
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
         struct geneve_sock *gs;
 
         gs = geneve_socket_create(net, port, rcv, data, ipv6);
@@ -305,15 +306,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
         if (no_share)   /* Return error if sharing is not allowed. */
                 return ERR_PTR(-EINVAL);
 
+        spin_lock(&gn->sock_lock);
         gs = geneve_find_sock(net, port);
-        if (gs) {
-                if (gs->rcv == rcv)
-                        atomic_inc(&gs->refcnt);
-                else
+        if (gs && ((gs->rcv != rcv) ||
+                   !atomic_add_unless(&gs->refcnt, 1, 0)))
                         gs = ERR_PTR(-EBUSY);
-        } else {
+        spin_unlock(&gn->sock_lock);
+
+        if (!gs)
                 gs = ERR_PTR(-EINVAL);
-        }
 
         return gs;
 }