mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-15 23:25:07 +00:00
can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
commit2b17c400ae
upstream. A race condition was found in isotp_setsockopt() which allows to change socket options after the socket was bound. For the specific case of SF_BROADCAST support, this might lead to possible use-after-free because can_rx_unregister() is not called. Checking for the flag under the socket lock in isotp_bind() and taking the lock in isotp_setsockopt() fixes the issue. Fixes:921ca574cd
("can: isotp: add SF_BROADCAST support for functional addressing") Link: https://lore.kernel.org/r/trinity-e6ae9efa-9afb-4326-84c0-f3609b9b8168-1620773528307@3c-app-gmx-bs06 Reported-by: Norbert Slusarek <nslusarek@gmx.net> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Norbert Slusarek <nslusarek@gmx.net> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
db3f3636e4
commit
5d42865fc3
1 changed files with 17 additions and 4 deletions
|
@ -1193,16 +1193,13 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
|
|||
return ISOTP_MIN_NAMELEN;
|
||||
}
|
||||
|
||||
static int isotp_setsockopt(struct socket *sock, int level, int optname,
|
||||
static int isotp_setsockopt_locked(struct socket *sock, int level, int optname,
|
||||
sockptr_t optval, unsigned int optlen)
|
||||
{
|
||||
struct sock *sk = sock->sk;
|
||||
struct isotp_sock *so = isotp_sk(sk);
|
||||
int ret = 0;
|
||||
|
||||
if (level != SOL_CAN_ISOTP)
|
||||
return -EINVAL;
|
||||
|
||||
if (so->bound)
|
||||
return -EISCONN;
|
||||
|
||||
|
@ -1277,6 +1274,22 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname,
|
|||
return ret;
|
||||
}
|
||||
|
||||
static int isotp_setsockopt(struct socket *sock, int level, int optname,
|
||||
sockptr_t optval, unsigned int optlen)
|
||||
|
||||
{
|
||||
struct sock *sk = sock->sk;
|
||||
int ret;
|
||||
|
||||
if (level != SOL_CAN_ISOTP)
|
||||
return -EINVAL;
|
||||
|
||||
lock_sock(sk);
|
||||
ret = isotp_setsockopt_locked(sock, level, optname, optval, optlen);
|
||||
release_sock(sk);
|
||||
return ret;
|
||||
}
|
||||
|
||||
static int isotp_getsockopt(struct socket *sock, int level, int optname,
|
||||
char __user *optval, int __user *optlen)
|
||||
{
|
||||
|
|
Loading…
Reference in a new issue