tree f6e8c49755225c5735ac25fa3a07ab454c488c1b
parent 1f6724aacfc39768b4387507d9fca14e990c293f
author Duoming Zhou <duoming@zju.edu.cn> 1648291426 +0800
committer Michael Kochera <kochera@google.com> 1654105724 +0000

net/x25: Fix null-ptr-deref caused by x25_disconnect

[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ]

When the link layer is terminating, x25->neighbour will be set to NULL
in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in
x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is
shown below.

    (Thread 1)                 |  (Thread 2)
x25_link_terminated()          | x25_recvmsg()
 x25_kill_by_neigh()           |  ...
  x25_disconnect()             |  lock_sock(sk)
   ...                         |  ...
   x25->neighbour = NULL //(1) |
   ...                         |  x25->neighbour->extended //(2)

The code sets NULL to x25->neighbour in position (1) and dereferences
x25->neighbour in position (2), which could cause null-ptr-deref bug.

This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize
with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the
sock held by lock_sock() is not NULL, because it is extracted from x25_list
and uses x25_list_lock to synchronize.

BUG=b/233870221
TEST=http://sponge2/344c0d46-9743-4275-8853-f04312939664
RELEASE_NOTE=Fixed CVE-2022-1516 in Linux Kernel
SOURCE=UPSTREAM(7781607938c8371d4c2b243527430241c62e39c2)

cos-patch: security-moderate
Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Change-Id: I86c41503e48152fa742e4e856177ff197336644e
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/33301
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>