net/sctp: fix race condition in sctp_destroy_sock
authorOr Cohen <orcohen@paloaltonetworks.com>
Tue, 13 Apr 2021 18:10:31 +0000 (21:10 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 21 Apr 2021 11:00:50 +0000 (13:00 +0200)
commit5a627026be4a17e5b9db23558cd28e62b2cbc66e
tree8e47cdee8f223a13f37b9dd9e61a18aef5bd6ee5
parent65f1995ea1e930674e76c5888b4643581e11434c
net/sctp: fix race condition in sctp_destroy_sock

commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b upstream.

If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.

This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
   attached to BPF_CGROUP_INET_SOCK_CREATE which denies
   creation of the sctp socket.

The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.

This addresses CVE-2021-23133.

Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/sctp/socket.c