On Mon, Oct 4, 2021 at 3:00 PM Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
From: Eric Dumazet edumazet@google.com
[ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]
Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
In order to fix this issue, this patch adds a new spinlock that needs to be used whenever these fields are read or written.
Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently reading sk->sk_peer_pid which makes no sense, as this field is only possibly set by AF_UNIX sockets. We will have to clean this in a separate patch. This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback" or implementing what was truly expected.
Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.")
From what I can tell, this fix only went into the stable trees for =4.14? SO_PEERGROUPS only appeared in 4.13, but the SO_PEERCRED in
4.4 and 4.9 seems to have exactly the same UAF read as it has on the newer kernels.