tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

net: kcm: Fix race condition in kcm_unattach()

syzbot found a race condition when kcm_unattach(psock)
and kcm_release(kcm) are executed at the same time.

kcm_unattach() is missing a check of the flag
kcm->tx_stopped before calling queue_work().

If the kcm has a reserved psock, kcm_unattach() might get executed
between cancel_work_sync() and unreserve_psock() in kcm_release(),
requeuing kcm->tx_work right before kcm gets freed in kcm_done().

Remove kcm->tx_stopped and replace it by the less
error-prone disable_work_sync().

Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Reported-by: syzbot+e62c9db591c30e174662@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e62c9db591c30e174662
Reported-by: syzbot+d199b52665b6c3069b94@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d199b52665b6c3069b94
Reported-by: syzbot+be6b1fdfeae512726b4e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=be6b1fdfeae512726b4e
Signed-off-by: Sven Stegemann <sven@stegemann.de>
Link: https://patch.msgid.link/20250812191810.27777-1-sven@stegemann.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Sven Stegemann and committed by
Jakub Kicinski 52565a93 1c756093

+2 -9
-1
include/net/kcm.h
··· 71 71 struct list_head wait_psock_list; 72 72 struct sk_buff *seq_skb; 73 73 struct mutex tx_mutex; 74 - u32 tx_stopped : 1; 75 74 76 75 /* Don't use bit fields here, these are set under different locks */ 77 76 bool tx_wait;
+2 -8
net/kcm/kcmsock.c
··· 430 430 431 431 /* Check if the socket is reserved so someone is waiting for sending. */ 432 432 kcm = psock->tx_kcm; 433 - if (kcm && !unlikely(kcm->tx_stopped)) 433 + if (kcm) 434 434 queue_work(kcm_wq, &kcm->tx_work); 435 435 436 436 spin_unlock_bh(&mux->lock); ··· 1693 1693 */ 1694 1694 __skb_queue_purge(&sk->sk_write_queue); 1695 1695 1696 - /* Set tx_stopped. This is checked when psock is bound to a kcm and we 1697 - * get a writespace callback. This prevents further work being queued 1698 - * from the callback (unbinding the psock occurs after canceling work. 1699 - */ 1700 - kcm->tx_stopped = 1; 1701 - 1702 1696 release_sock(sk); 1703 1697 1704 1698 spin_lock_bh(&mux->lock); ··· 1708 1714 /* Cancel work. After this point there should be no outside references 1709 1715 * to the kcm socket. 1710 1716 */ 1711 - cancel_work_sync(&kcm->tx_work); 1717 + disable_work_sync(&kcm->tx_work); 1712 1718 1713 1719 lock_sock(sk); 1714 1720 psock = kcm->tx_psock;