CVE-2024-35910: tcp: properly terminate timers for kernel sockets

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often, and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inetcskclearxmittimers() to 'stop' the timers.

inetcskclearxmittimers() can be called from any context, including when socket lock is held. This is the reason it uses skstoptimer(), aka deltimer(). This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer holds a reference on the socket, and the user socket holds a reference on the netns.

For kernel sockets, we risk that the netns is freed before timer can complete, because kernel sockets do not hold reference on the netns.

This patch adds inetcskclearxmittimerssync() function that using skstoptimersync() to make sure all timers are terminated before the kernel socket is released. Modules using kernel sockets close them in their netns exit() handler.

Also add socknotownedbyme() helper to get LOCKDEP support : inetcskclearxmittimerssync() must not be called while socket lock is held.

It is very possible we can revert in the future commit 3a58f13a881e ("net: rds: acquire refcount on TCP sockets") which attempted to solve the issue in rds only. (net/smc/afsmc.c and net/mptcp/subflow.c have similar code)

We probably can remove the checknet() tests from tcpoutofresources() and tcpclose() in the future.

— NVD

Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw with improperly terminate timers for kernel sockets. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.

— IBM