lkml.org 
[lkml]   [2018]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.18 12/76] bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg
    Date
    From: Daniel Borkmann <daniel@iogearbox.net>

    [ Upstream commit 15c480efab01197c965ce0562a43ffedd852b8f9 ]

    In bpf_tcp_recvmsg() we first took a reference on the psock, however
    once we find that there are skbs in the normal socket's receive queue
    we return with processing them through tcp_recvmsg(). Problem is that
    we leak the taken reference on the psock in that path. Given we don't
    really do anything with the psock at this point, move the skb_queue_empty()
    test before we fetch the psock to fix this case.

    Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    kernel/bpf/sockmap.c | 5 ++---
    1 file changed, 2 insertions(+), 3 deletions(-)

    diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
    index 7afa2a54ee34..e43730b52ea6 100644
    --- a/kernel/bpf/sockmap.c
    +++ b/kernel/bpf/sockmap.c
    @@ -915,6 +915,8 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,

    if (unlikely(flags & MSG_ERRQUEUE))
    return inet_recv_error(sk, msg, len, addr_len);
    + if (!skb_queue_empty(&sk->sk_receive_queue))
    + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);

    rcu_read_lock();
    psock = smap_psock_sk(sk);
    @@ -925,9 +927,6 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
    goto out;
    rcu_read_unlock();

    - if (!skb_queue_empty(&sk->sk_receive_queue))
    - return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
    -
    lock_sock(sk);
    bytes_ready:
    while (copied != len) {
    --
    2.17.1
    \
     
     \ /
      Last update: 2018-09-24 17:11    [W:4.155 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site