Commit 52565a93 authored by Sven Stegemann's avatar Sven Stegemann Committed by Jakub Kicinski
Browse files

net: kcm: Fix race condition in kcm_unattach() 



syzbot found a race condition when kcm_unattach(psock)
and kcm_release(kcm) are executed at the same time.

kcm_unattach() is missing a check of the flag
kcm->tx_stopped before calling queue_work().

If the kcm has a reserved psock, kcm_unattach() might get executed
between cancel_work_sync() and unreserve_psock() in kcm_release(),
requeuing kcm->tx_work right before kcm gets freed in kcm_done().

Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().

Fixes: ab7ac4eb ("kcm: Kernel Connection Multiplexor module")
Reported-by: default avatar <syzbot+e62c9db591c30e174662@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=e62c9db591c30e174662


Reported-by: default avatar <syzbot+d199b52665b6c3069b94@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=d199b52665b6c3069b94


Reported-by: default avatar <syzbot+be6b1fdfeae512726b4e@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=be6b1fdfeae512726b4e


Signed-off-by: default avatarSven Stegemann <sven@stegemann.de>
Link: https://patch.msgid.link/20250812191810.27777-1-sven@stegemann.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1c756093

include/net/kcm.h

+0 −1
Original line number Diff line number Diff line
@@ -71,7 +71,6 @@ struct kcm_sock { 
	struct list_head wait_psock_list;

	struct sk_buff *seq_skb;

	struct mutex tx_mutex;

	u32 tx_stopped : 1;



	/* Don't use bit fields here, these are set under different locks */

	bool tx_wait;

net/kcm/kcmsock.c

+2 −8
Original line number Diff line number Diff line
@@ -430,7 +430,7 @@ static void psock_write_space(struct sock *sk) 


	/* Check if the socket is reserved so someone is waiting for sending. */

	kcm = psock->tx_kcm;

	if (kcm && !unlikely(kcm->tx_stopped))

	if (kcm)

		queue_work(kcm_wq, &kcm->tx_work);



	spin_unlock_bh(&mux->lock);
@@ -1693,12 +1693,6 @@ static int kcm_release(struct socket *sock) 
	 */

	__skb_queue_purge(&sk->sk_write_queue);



	/* Set tx_stopped. This is checked when psock is bound to a kcm and we

	 * get a writespace callback. This prevents further work being queued

	 * from the callback (unbinding the psock occurs after canceling work.

	 */

	kcm->tx_stopped = 1;



	release_sock(sk);



	spin_lock_bh(&mux->lock);
@@ -1714,7 +1708,7 @@ static int kcm_release(struct socket *sock) 
	/* Cancel work. After this point there should be no outside references

	 * to the kcm socket.

	 */

	cancel_work_sync(&kcm->tx_work);

	disable_work_sync(&kcm->tx_work);



	lock_sock(sk);

	psock = kcm->tx_psock;