forge/linux-uconsole
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
linux-uconsole/net
History
Liu Jian 65029aaedd net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory 
[ Upstream commit 3f8ef65af9 ]

Fixes the below NULL pointer dereference:

  [...]
  [   14.471200] Call Trace:
  [   14.471562]  <TASK>
  [   14.471882]  lock_acquire+0x245/0x2e0
  [   14.472416]  ? remove_wait_queue+0x12/0x50
  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50
  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50
  [   14.474318]  ? remove_wait_queue+0x12/0x50
  [   14.474907]  remove_wait_queue+0x12/0x50
  [   14.475480]  sk_stream_wait_memory+0x20d/0x340
  [   14.476127]  ? do_wait_intr_irq+0x80/0x80
  [   14.476704]  do_tcp_sendpages+0x287/0x600
  [   14.477283]  tcp_bpf_push+0xab/0x260
  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500
  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0
  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470
  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0
  [   14.480311]  sock_sendmsg+0x2d/0x40
  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0
  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80
  [   14.482048]  ___sys_sendmsg+0x78/0xb0
  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150
  [   14.483215]  ? __do_fault+0x2a/0x1a0
  [   14.483738]  ? do_fault+0x15e/0x5d0
  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040
  [   14.484874]  ? lock_is_held_type+0xdf/0x130
  [   14.485474]  ? find_held_lock+0x2d/0x90
  [   14.486046]  ? __sys_sendmsg+0x41/0x70
  [   14.486587]  __sys_sendmsg+0x41/0x70
  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350
  [   14.487822]  do_syscall_64+0x34/0x80
  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
  [...]

The test scenario has the following flow:

thread1                               thread2
-----------                           ---------------
 tcp_bpf_sendmsg
  tcp_bpf_send_verdict
   tcp_bpf_sendmsg_redir              sock_close
    tcp_bpf_push_locked                 __sock_release
     tcp_bpf_push                         //inet_release
      do_tcp_sendpages                    sock->ops->release
       sk_stream_wait_memory          	   // tcp_close
          sk_wait_event                      sk->sk_prot->close
           release_sock(__sk);
            ***
                                                lock_sock(sk);
                                                  __tcp_close
                                                    sock_orphan(sk)
                                                      sk->sk_wq  = NULL
                                                release_sock
            ****
           lock_sock(__sk);
          remove_wait_queue(sk_sleep(sk), &wait);
             sk_sleep(sk)
             //NULL pointer dereference
             &rcu_dereference_raw(sk->sk_wq)->wait

While waiting for memory in thread1, the socket is released with its wait
queue because thread2 has closed it. This caused by tcp_bpf_send_verdict
didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.

We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory
before accessing the wait queue.

Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/bpf/20220823133755.314697-2-liujian56@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:47 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-09-15 09:50:34 +02:00
9p net/9p: Initialize the iounit field during fid creation 2022-08-21 15:16:26 +02:00
802 net/802/garp: fix memleak in garp_request_join() 2021-07-31 08:16:11 +02:00
8021q net: make free_netdev() more lenient with unregistering devices 2022-07-29 17:19:07 +02:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 15:00:08 +02:00
atm
ax25 net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg 2022-06-22 14:13:17 +02:00
batman-adv batman-adv: Don't skb_split skbuffs with frag_list 2022-05-18 10:23:42 +02:00
bluetooth Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times 2022-10-26 13:25:46 +02:00
bpf bpf: Don't redirect packets with invalid pkt_len 2022-09-05 10:28:56 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-07-14 16:56:29 +02:00
bridge netfilter: ebtables: fix memory leak when blob is malformed 2022-09-28 11:10:36 +02:00
caif net-caif: avoid user-triggerable WARN_ON(1) 2021-09-22 12:27:56 +02:00
can can: bcm: check the result of can_send() in bcm_can_tx() 2022-10-26 13:25:47 +02:00
ceph libceph: fix potential use-after-free on linger ping and resends 2022-05-25 09:17:56 +02:00
core net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory 2022-10-26 13:25:47 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-08 19:09:37 +01:00
dccp dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock 2022-08-21 15:15:52 +02:00
decnet net: Fix data-races around sysctl_[rw]mem(_offset)?. 2022-08-31 17:15:19 +02:00
dns_resolver
dsa net: dsa: Add missing of_node_put() in dsa_port_link_register_of 2022-05-09 09:05:02 +02:00
ethernet
ethtool ethtool: do not perform operations on net devices being unregistered 2021-12-17 10:14:41 +01:00
hsr net: hsr: fix mac_len checks 2021-06-03 09:00:50 +02:00
ieee802154 net/ieee802154: reject zero-sized raw_sendmsg() 2022-10-26 13:25:23 +02:00
ife
ipv4 tcp: annotate data-race around tcp_md5sig_pool_populated 2022-10-26 13:25:45 +02:00
ipv6 netfilter: nft_fib: Fix for rpath check with VRF devices 2022-10-26 13:25:22 +02:00
iucv net/af_iucv: remove WARN_ONCE on malformed RX packets 2021-03-07 12:34:05 +01:00
kcm kcm: fix strp_init() order and cleanup 2022-09-08 11:11:37 +02:00
key af_key: Do not call xfrm_probe_algs in parallel 2022-08-31 17:15:15 +02:00
l2tp ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg 2022-06-22 14:13:15 +02:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-27 13:53:50 +02:00
lapb
llc llc: only change llc->dev when bind() succeeds 2022-03-28 09:57:10 +02:00
mac80211 wifi: mac80211: allow bw change during channel switch in mesh 2022-10-26 13:25:19 +02:00
mac802154 net: mac802154: Fix a condition in the receive path 2022-09-08 11:11:40 +02:00
mpls net: Use u64_stats_fetch_begin_irq() for stats fetch. 2022-09-08 11:11:40 +02:00
mptcp net: Fix data-races around sysctl_[rw]mem(_offset)?. 2022-08-31 17:15:19 +02:00
ncsi net/ncsi: check for error return from call to nla_put_u32 2022-01-05 12:40:32 +01:00
netfilter netfilter: nf_tables: fix percpu memory leak at nf_tables_addchain() 2022-09-28 11:10:35 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-04-13 21:01:00 +02:00
netlink net: genl: fix error path memory leak in policy dumping 2022-08-25 11:38:07 +02:00
netrom netrom: fix api breakage in nr_setsockopt() 2022-01-27 10:54:03 +01:00
nfc NFC: NULL out the dev->rfkill to prevent UAF 2022-06-09 10:21:01 +02:00
nsh
openvswitch openvswitch: Fix overreporting of drops in dropwatch 2022-10-26 13:25:45 +02:00
packet net/af_packet: check len when min_header_len equals to 0 2022-09-05 10:28:59 +02:00
phonet phonet: refcount leak in pep_sock_accep 2022-01-11 15:25:01 +01:00
psample net: psample: Fix netlink skb length with tunnel info 2021-03-07 12:34:07 +01:00
qrtr qrtr: Convert qrtr_ports from IDR to XArray 2022-08-25 11:38:23 +02:00
rds net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() 2022-10-26 13:25:23 +02:00
rfkill
rose rose: check NULL rose_loopback_neigh->loopback 2022-08-31 17:15:16 +02:00
rxrpc rxrpc: Fix calc of resend age 2022-09-23 14:16:59 +02:00
sched net: sched: act_ct: fix possible refcount leak in tcf_ct_init() 2022-10-05 10:38:42 +02:00
sctp sctp: handle the error returned from sctp_auth_asoc_init_active_key 2022-10-26 13:25:23 +02:00
smc net/smc: Stop the CLC flow if no link to map buffers on 2022-09-28 11:10:36 +02:00
strparser bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding 2021-11-18 14:04:27 +01:00
sunrpc SUNRPC: RPC level errors should set task->tk_rpc_status 2022-08-31 17:15:15 +02:00
switchdev
tipc tipc: fix shift wrapping bug in map_get() 2022-09-15 11:32:05 +02:00
tls net/tls: Remove the context from the list in tls_device_down 2022-08-03 12:00:46 +02:00
unix af_unix: Fix a data-race in unix_dgram_peer_wake_me(). 2022-06-14 18:32:40 +02:00
vmw_vsock vhost/vsock: Use kvmalloc/kvfree for larger packets. 2022-10-26 13:25:22 +02:00
wimax
wireless wifi: cfg80211: update hidden BSSes to avoid WARN_ON 2022-10-15 07:55:56 +02:00
x25 net/x25: Fix null-ptr-deref caused by x25_disconnect 2022-04-08 14:40:30 +02:00
xdp xsk: Inherit need_wakeup flag for shared sockets 2022-10-15 07:55:51 +02:00
xfrm xfrm: Update ipcomp_scratches with NULL when freed 2022-10-26 13:25:46 +02:00
compat.c net: Return the correct errno code 2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c net: Fix a data-race around sysctl_somaxconn. 2022-08-31 17:15:21 +02:00
sysctl_net.c