netdev - RE: [PATCH bpf-next v3 4/4] bpf, sockmap: Fix double uncharge the mem of sk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Mar 2022 13:51:41 -0800
From:   John Fastabend <john.fastabend@...il.com>
To:     Wang Yufen <wangyufen@...wei.com>, john.fastabend@...il.com,
        daniel@...earbox.net, jakub@...udflare.com, lmb@...udflare.com,
        davem@...emloft.net, bpf@...r.kernel.org
Cc:     edumazet@...gle.com, yoshfuji@...ux-ipv6.org, dsahern@...nel.org,
        kuba@...nel.org, ast@...nel.org, andrii@...nel.org, kafai@...com,
        songliubraving@...com, yhs@...com, kpsingh@...nel.org,
        netdev@...r.kernel.org, Wang Yufen <wangyufen@...wei.com>
Subject: RE: [PATCH bpf-next v3 4/4] bpf, sockmap: Fix double uncharge the mem
 of sk_msg

Wang Yufen wrote:
> If tcp_bpf_sendmsg is running during a tear down operation, psock may be
> freed.
> 
> tcp_bpf_sendmsg()
>  tcp_bpf_send_verdict()
>   sk_msg_return()
>   tcp_bpf_sendmsg_redir()
>    unlikely(!psock))
>      sk_msg_free()
> 
> The mem of msg has been uncharged in tcp_bpf_send_verdict() by
> sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock
> is null, we can simply returning an error code, this would then trigger
> the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have
> the side effect of throwing an error up to user space. This would be a
> slight change in behavior from user side but would look the same as an
> error if the redirect on the socket threw an error.
> 
> This issue can cause the following info:
> WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260
> Call Trace:
>  <TASK>
>  __sk_destruct+0x24/0x1f0
>  sk_psock_destroy+0x19b/0x1c0
>  process_one_work+0x1b3/0x3c0
>  worker_thread+0x30/0x350
>  ? process_one_work+0x3c0/0x3c0
>  kthread+0xe6/0x110
>  ? kthread_complete_and_exit+0x20/0x20
>  ret_from_fork+0x22/0x30
>  </TASK>
> 
> Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
> Signed-off-by: Wang Yufen <wangyufen@...wei.com>
> ---
>  net/ipv4/tcp_bpf.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)

Thanks John!

Acked-by: John Fastabend <john.fastabend@...il.com>