lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250609042024.ta4fuiogxxklolst@gmail.com> Date: Sun, 8 Jun 2025 21:20:24 -0700 From: John Fastabend <john.fastabend@...il.com> To: Jiayuan Chen <jiayuan.chen@...ux.dev> Cc: bpf@...r.kernel.org, Jakub Sitnicki <jakub@...udflare.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH bpf-next v2] bpf, sockmap: Fix psock incorrectly pointing to sk On 2025-06-09 10:59:08, Jiayuan Chen wrote: > We observed an issue from the latest selftest: sockmap_redir where > sk_psock(psock->sk) != psock in the backlog. The root cause is the special > behavior in sockmap_redir - it frequently performs map_update() and > map_delete() on the same socket. During map_update(), we create a new > psock and during map_delete(), we eventually free the psock via rcu_work > in sk_psock_drop(). However, pending workqueues might still exist and not > be processed yet. If users immediately perform another map_update(), a new > psock will be allocated for the same sk, resulting in two psocks pointing > to the same sk. > > When the pending workqueue is later triggered, it uses the old psock to > access sk for I/O operations, which is incorrect. [...] > > Note: We cannot call cancel_delayed_work_sync() in map_delete() since this > might be invoked in BPF context by BPF helper, and the function may sleep. > > Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") > Signed-off-by: Jiayuan Chen <jiayuan.chen@...ux.dev> > > --- > V1->V2: Use existing flag instead of adding new one. > https://lore.kernel.org/bpf/20250605142448.3llri3w7wbclfxwc@gmail.com/ > > Thanks to Michal Luczaj for providing the sockmap_redir test case, which > indeed covers almost all sockmap forwarding paths. > --- > net/core/skmsg.c | 7 +++++++ > 1 file changed, 7 insertions(+) > Reviewed-by: John Fastabend <john.fastabend@...il.com>
Powered by blists - more mailing lists