lkml.org 
[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.18 052/168] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
    Date
    4.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: John Fastabend <john.fastabend@gmail.com>

    [ Upstream commit 597222f72a94118f593e4f32bf58ae7e049a0df1 ]

    Currently we check sk_user_data is non NULL to determine if the sk
    exists in a map. However, this is not sufficient to ensure the psock
    or the ULP ops are not in use by another user, such as kcm or TLS. To
    avoid this when adding a sock to a map also verify it is of the
    correct ULP type. Additionally, when releasing a psock verify that
    it is the TCP_ULP_BPF type before releasing the ULP. The error case
    where we abort an update due to ULP collision can cause this error
    path.

    For example,

    __sock_map_ctx_update_elem()
    [...]
    err = tcp_set_ulp_id(sock, TCP_ULP_BPF) <- collides with TLS
    if (err) <- so err out here
    goto out_free
    [...]
    out_free:
    smap_release_sock() <- calling tcp_cleanup_ulp releases the
    TLS ULP incorrectly.

    Fixes: 2f857d04601a ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support")
    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/sockmap.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    --- a/kernel/bpf/sockmap.c
    +++ b/kernel/bpf/sockmap.c
    @@ -1465,10 +1465,16 @@ static void smap_destroy_psock(struct rc
    schedule_work(&psock->gc_work);
    }

    +static bool psock_is_smap_sk(struct sock *sk)
    +{
    + return inet_csk(sk)->icsk_ulp_ops == &bpf_tcp_ulp_ops;
    +}
    +
    static void smap_release_sock(struct smap_psock *psock, struct sock *sock)
    {
    if (refcount_dec_and_test(&psock->refcnt)) {
    - tcp_cleanup_ulp(sock);
    + if (psock_is_smap_sk(sock))
    + tcp_cleanup_ulp(sock);
    write_lock_bh(&sock->sk_callback_lock);
    smap_stop_sock(psock, sock);
    write_unlock_bh(&sock->sk_callback_lock);
    @@ -1895,6 +1901,10 @@ static int __sock_map_ctx_update_elem(st
    * doesn't update user data.
    */
    if (psock) {
    + if (!psock_is_smap_sk(sock)) {
    + err = -EBUSY;
    + goto out_progs;
    + }
    if (READ_ONCE(psock->bpf_parse) && parse) {
    err = -EBUSY;
    goto out_progs;

    \
     
     \ /
      Last update: 2018-10-08 21:02    [W:4.123 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site