lkml.org 
[lkml]   [2018]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 090/115] bpf: sockmap missing NULL psock check
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: John Fastabend <john.fastabend@gmail.com>


    [ Upstream commit 5731a879d03bdaa00265f8ebc32dfd0e65d25276 ]

    Add psock NULL check to handle a racing sock event that can get the
    sk_callback_lock before this case but after xchg happens causing the
    refcnt to hit zero and sock user data (psock) to be null and queued
    for garbage collection.

    Also add a comment in the code because this is a bit subtle and
    not obvious in my opinion.

    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/sockmap.c | 11 +++++++++--
    1 file changed, 9 insertions(+), 2 deletions(-)

    --- a/kernel/bpf/sockmap.c
    +++ b/kernel/bpf/sockmap.c
    @@ -588,8 +588,15 @@ static void sock_map_free(struct bpf_map

    write_lock_bh(&sock->sk_callback_lock);
    psock = smap_psock_sk(sock);
    - smap_list_remove(psock, &stab->sock_map[i]);
    - smap_release_sock(psock, sock);
    + /* This check handles a racing sock event that can get the
    + * sk_callback_lock before this case but after xchg happens
    + * causing the refcnt to hit zero and sock user data (psock)
    + * to be null and queued for garbage collection.
    + */
    + if (likely(psock)) {
    + smap_list_remove(psock, &stab->sock_map[i]);
    + smap_release_sock(psock, sock);
    + }
    write_unlock_bh(&sock->sk_callback_lock);
    }
    rcu_read_unlock();

    \
     
     \ /
      Last update: 2018-03-02 10:28    [W:4.025 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site