kcm: Check if sk_user_data already set in kcm_attach
authorTom Herbert <tom@quantonium.net>
Wed, 24 Jan 2018 20:35:41 +0000 (12:35 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Feb 2018 10:07:45 +0000 (11:07 +0100)
commit44890e9ff771ef11777b2d1ebf8589255eb12502
tree9c1cee66395f1e8a87d86928161416bb405006f7
parented25667f33032b7715bc4af67e6728020fe75f5e
kcm: Check if sk_user_data already set in kcm_attach

commit e5571240236c5652f3e079b1d5866716a7ad819c upstream.

This is needed to prevent sk_user_data being overwritten.
The check is done under the callback lock. This should prevent
a socket from being attached twice to a KCM mux. It also prevents
a socket from being attached for other use cases of sk_user_data
as long as the other cases set sk_user_data under the lock.
Followup work is needed to unify all the use cases of sk_user_data
to use the same locking.

Reported-by: syzbot+114b15f2be420a8886c3@syzkaller.appspotmail.com
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Tom Herbert <tom@quantonium.net>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/kcm/kcmsock.c