github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tcp: avoid double destroy in tcp_abort() of an unaccepted child

Browse Source 
tcp_abort() checks for TCP_CLOSE while only owning the socket lock,
then grabs the BH lock before calling tcp_done_with_error().

For a child still sitting in a listener accept queue (which can be
reached via SOCK_DESTROY or bpf_sock_destroy()), inet_csk_listen_stop()
can run in this window: it only holds the child BH lock, and calls
inet_child_forget(), which disconnects, orphans and destroys the child.

tcp_abort() then calls tcp_done_with_error() -> tcp_done(), which sees
SOCK_DEAD and calls inet_csk_destroy_sock() a second time, leading to
a double sock_put() and a use-after-free.

Recheck TCP_CLOSE after acquiring the BH lock, unless we just closed
a listener ourselves, in which case tcp_done_with_error() must still
run to report the error.

Note that the WARN_ON(sock_owned_by_user(child)) in
inet_csk_listen_stop() can still trigger in this window.

Fixes: bac76cf898 ("tcp: fix forever orphan socket caused by tcp_abort")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
[edumazet: recheck TCP_CLOSE under the BH lock instead of moving the test, smaller diff]
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20261028160847.2170959-1-edumazet@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Kyle Zeng 2026-10-28 17:08:47 +01:00 committed by Jakub Kicinski
parent 4f45e97b3a
commit dbd62ad55a
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/ipv4/tcp.c
View File

@ -5127,6 +5127,8 @@ void tcp_done(struct sock *sk)
int tcp_abort(struct sock *sk, int err)
{
int state = inet_sk_state_load(sk);
bool listener = false;
int ret = 0;
if (state == TCP_NEW_SYN_RECV) {
struct request_sock *req = inet_reqsk(sk);
@ -5161,21 +5163,31 @@ int tcp_abort(struct sock *sk, int err)
if (sk->sk_state == TCP_LISTEN) {
tcp_set_state(sk, TCP_CLOSE);
inet_csk_listen_stop(sk);
listener = true;
}
/* Don't race with BH socket closes such as inet_csk_listen_stop. */
local_bh_disable();
bh_lock_sock(sk);
/* An unaccepted child might have been closed by
* inet_csk_listen_stop() while we were not holding its BH lock.
*/
if (!listener && sk->sk_state == TCP_CLOSE) {
ret = -ENOENT;
goto out;
}
if (tcp_need_reset(sk->sk_state))
tcp_send_active_reset(sk, SK_RST_REASON_TCP_STATE);
tcp_done_with_error(sk, err);
out:
bh_unlock_sock(sk);
local_bh_enable();
if (!has_current_bpf_ctx())
release_sock(sk);
return 0;
return ret;
}
EXPORT_SYMBOL_GPL(tcp_abort);