[PATCH net] net/af_iucv: fix use-after-free of listen sock in iucv_callback_connreq()

[Hidayath Khan <hidayath@linux.ibm.com>]

iucv_callback_connreq() looks up the listening socket in iucv_sk_list
under read_lock(&iucv_sk_list.lock), drops the lock, and only then
uses the socket (bh_lock_sock() and the following connection setup).
No reference is taken on the socket before the lock is released.

The callback runs from the iucv tasklet. A concurrent close of the
listening socket does not synchronize with it.
Between read_unlock() and bh_lock_sock() a concurrent close on another
CPU can free the socket.

Fixes: eac3731bd04c ("[S390]: Add AF_IUCV socket support")
Cc: stable@vger.kernel.org
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
---
 net/iucv/af_iucv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index fed240b453bd..890d9df5ae36 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1616,6 +1616,8 @@ static int iucv_callback_connreq(struct iucv_path *path,
 			iucv = iucv_sk(sk);
 			break;
 		}
+	if (iucv)
+		sock_hold(sk);
 	read_unlock(&iucv_sk_list.lock);
 	if (!iucv)
 		/* No socket found, not one of our paths. */
@@ -1684,6 +1686,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
 	err = 0;
 fail:
 	bh_unlock_sock(sk);
+	sock_put(sk);
 	return 0;
 }
 
-- 
2.52.0