From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Wang Subject: [Patch net] rds: mark bound socket with SOCK_RCU_FREE Date: Mon, 10 Sep 2018 15:24:22 -0700 Message-ID: <20180910222422.19470-1-xiyou.wangcong@gmail.com> Cc: Cong Wang , Sowmini Varadhan , Santosh Shilimkar , rds-devel@oss.oracle.com To: netdev@vger.kernel.org Return-path: Received: from mail-pl1-f196.google.com ([209.85.214.196]:36512 "EHLO mail-pl1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726426AbeIKDUq (ORCPT ); Mon, 10 Sep 2018 23:20:46 -0400 Received: by mail-pl1-f196.google.com with SMTP id p5-v6so2906658plk.3 for ; Mon, 10 Sep 2018 15:24:34 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: When a rds sock is bound, it is inserted into the bind_hash_table which is protected by RCU. But when releasing rd sock, after it is removed from this hash table, it is freed immediately without respecting RCU grace period. This could cause some use-after-free as reported by syzbot. Mark the rds sock as SOCK_RCU_FREE before inserting it into the bind_hash_table, so that it would be always freed after a RCU grace period. Reported-and-tested-by: syzbot+8967084bcac563795dc6@syzkaller.appspotmail.com Cc: Sowmini Varadhan Cc: Santosh Shilimkar Cc: rds-devel@oss.oracle.com Signed-off-by: Cong Wang --- net/rds/bind.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/rds/bind.c b/net/rds/bind.c index 3ab55784b637..2281b34415b9 100644 --- a/net/rds/bind.c +++ b/net/rds/bind.c @@ -235,6 +235,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) goto out; } + sock_set_flag(sk, SOCK_RCU_FREE); ret = rds_add_bound(rs, binding_addr, &port, scope_id); if (ret) goto out; -- 2.14.4