kcm: Check if sk_user_data already set in kcm_attach
authorTom Herbert <tom@quantonium.net>
Wed, 24 Jan 2018 20:35:41 +0000 (12:35 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Feb 2018 10:05:40 +0000 (11:05 +0100)
commit085cbbda4b4cc7dd2ba63806346881c2c2e10107
tree241be7f4e963529c188c72a40ab3380bc85401f2
parentbd3ccdc6f922c6b7db4b7075d1b6596ddb986a98
kcm: Check if sk_user_data already set in kcm_attach

commit e5571240236c5652f3e079b1d5866716a7ad819c upstream.

This is needed to prevent sk_user_data being overwritten.
The check is done under the callback lock. This should prevent
a socket from being attached twice to a KCM mux. It also prevents
a socket from being attached for other use cases of sk_user_data
as long as the other cases set sk_user_data under the lock.
Followup work is needed to unify all the use cases of sk_user_data
to use the same locking.

Reported-by: syzbot+114b15f2be420a8886c3@syzkaller.appspotmail.com
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Tom Herbert <tom@quantonium.net>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/kcm/kcmsock.c