vsock: fix locking in vsock_shutdown()

commit 1c5fae9c9a092574398a17facc31c533791ef232 upstream.

In vsock_shutdown() we touched some socket fields without holding the
socket lock, such as 'state' and 'sk_flags'.

Also, after the introduction of multi-transport, we are accessing
'vsk->transport' in vsock_send_shutdown() without holding the lock
and this call can be made while the connection is in progress, so
the transport can change in the meantime.

To avoid issues, we hold the socket lock when we enter in
vsock_shutdown() and release it when we leave.

Among the transports that implement the 'shutdown' callback, only
hyperv_transport acquired the lock. Since the caller now holds it,
we no longer take it.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 89a57ed99abb26f0625c30ea6d7bc8a7f902bef4..5d323574d04feba787816e9daab8c9fbeab3214b 100644 (file)
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -808,10 +808,12 @@ static int vsock_shutdown(struct socket *sock, int mode)
         */
 
        sk = sock->sk;
+
+       lock_sock(sk);
        if (sock->state == SS_UNCONNECTED) {
                err = -ENOTCONN;
                if (sk->sk_type == SOCK_STREAM)
-                       return err;
+                       goto out;
        } else {
                sock->state = SS_DISCONNECTING;
                err = 0;
@@ -820,10 +822,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
        /* Receive and send shutdowns are treated alike. */
        mode = mode & (RCV_SHUTDOWN | SEND_SHUTDOWN);
        if (mode) {
-               lock_sock(sk);
                sk->sk_shutdown |= mode;
                sk->sk_state_change(sk);
-               release_sock(sk);
 
                if (sk->sk_type == SOCK_STREAM) {
                        sock_reset_flag(sk, SOCK_DONE);
@@ -831,6 +831,8 @@ static int vsock_shutdown(struct socket *sock, int mode)
                }
        }
 
+out:
+       release_sock(sk);
        return err;
 }
 

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index 463cefc1e5ae2533304c0a62c53d1a53f88a8d88..a3c57c048cbd89df9de8c5e70a89995cbc50f6c7 100644 (file)
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -464,14 +464,10 @@ static void hvs_shutdown_lock_held(struct hvsock *hvs, int mode)
 
 static int hvs_shutdown(struct vsock_sock *vsk, int mode)
 {
-       struct sock *sk = sk_vsock(vsk);
-
        if (!(mode & SEND_SHUTDOWN))
                return 0;
 
-       lock_sock(sk);
        hvs_shutdown_lock_held(vsk->trans, mode);
-       release_sock(sk);
        return 0;
 }