diff options
| author | WANG Cong <xiyou.wangcong@gmail.com> | 2017-01-23 11:17:35 -0800 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-07-04 11:51:31 +0200 |
| commit | 8856b3e0e8482eb3ffed8ef733bae0f3877a4d71 (patch) | |
| tree | f26aab84d06768aa86ad0f1ab7d250223a8797de /net/unix | |
| parent | e450a7d4b9603956a98e80b54906a214bb4c50ed (diff) | |
af_unix: move unix_mknod() out of bindlock
commit 0fb44559ffd67de8517098b81f675fa0210f13f0 upstream.
Dmitry reported a deadlock scenario:
unix_bind() path:
u->bindlock ==> sb_writer
do_splice() path:
sb_writer ==> pipe->mutex ==> u->bindlock
In the unix_bind() code path, unix_mknod() does not have to
be done with u->bindlock held, since it is a pure fs operation,
so we can just move unix_mknod() out.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'net/unix')
| -rw-r--r-- | net/unix/af_unix.c | 29 |
1 files changed, 18 insertions, 11 deletions
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 99e986851..184342f13 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -999,6 +999,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) unsigned int hash = 0; struct unix_address *addr; struct hlist_head *list; + struct path path = { NULL, NULL }; err = -EINVAL; if (sunaddr->sun_family != AF_UNIX) @@ -1014,9 +1015,22 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) goto out; addr_len = err; + if (sun_path[0]) { + umode_t mode = S_IFSOCK | + (SOCK_INODE(sock)->i_mode & ~current_umask()); + path.dentry = NULL; + path.mnt = NULL; + err = unix_mknod(sun_path, mode, &path); + if (err) { + if (err == -EEXIST) + err = -EADDRINUSE; + goto out; + } + } + err = mutex_lock_interruptible(&u->readlock); if (err) - goto out; + goto out_put; err = -EINVAL; if (u->addr) @@ -1033,16 +1047,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) atomic_set(&addr->refcnt, 1); if (sun_path[0]) { - struct path path = {0}; - umode_t mode = S_IFSOCK | - (SOCK_INODE(sock)->i_mode & ~current_umask()); - err = unix_mknod(sun_path, mode, &path); - if (err) { - if (err == -EEXIST) - err = -EADDRINUSE; - unix_release_addr(addr); - goto out_up; - } addr->hash = UNIX_HASH_SIZE; hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1); spin_lock(&unix_table_lock); @@ -1069,6 +1073,9 @@ out_unlock: spin_unlock(&unix_table_lock); out_up: mutex_unlock(&u->readlock); +out_put: + if (err) + path_put(&path); out: return err; |