From: Cong Wang <[email protected]> Date: Mon, 10 Sep 2018 18:27:26 -0700
> When a rds sock is bound, it is inserted into the bind_hash_table > which is protected by RCU. But when releasing rds sock, after it > is removed from this hash table, it is freed immediately without > respecting RCU grace period. This could cause some use-after-free > as reported by syzbot. > > Mark the rds sock with SOCK_RCU_FREE before inserting it into the > bind_hash_table, so that it would be always freed after a RCU grace > period. > > The other problem is in rds_find_bound(), the rds sock could be > freed in between rhashtable_lookup_fast() and rds_sock_addref(), > so we need to extend RCU read lock protection in rds_find_bound() > to close this race condition. > > Reported-and-tested-by: [email protected] > Reported-by: [email protected] > Cc: Sowmini Varadhan <[email protected]> > Cc: Santosh Shilimkar <[email protected]> > Cc: [email protected] > Signed-off-by: Cong Wang <[email protected]> Applied and queued up for -stable, thanks.
