lkml.org 
[lkml]   [2019]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.1 050/115] bpf: sockmap remove duplicate queue free
    Date
    [ Upstream commit c42253cc88206fd0e9868c8b2fd7f9e79f9e0e03 ]

    In tcp bpf remove we free the cork list and purge the ingress msg
    list. However we do this before the ref count reaches zero so it
    could be possible some other access is in progress. In this case
    (tcp close and/or tcp_unhash) we happen to also hold the sock
    lock so no path exists but lets fix it otherwise it is extremely
    fragile and breaks the reference counting rules. Also we already
    check the cork list and ingress msg queue and free them once the
    ref count reaches zero so its wasteful to check twice.

    Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/ipv4/tcp_bpf.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
    index 1bb7321a256d..4a619c85daed 100644
    --- a/net/ipv4/tcp_bpf.c
    +++ b/net/ipv4/tcp_bpf.c
    @@ -528,8 +528,6 @@ static void tcp_bpf_remove(struct sock *sk, struct sk_psock *psock)
    {
    struct sk_psock_link *link;

    - sk_psock_cork_free(psock);
    - __sk_psock_purge_ingress_msg(psock);
    while ((link = sk_psock_link_pop(psock))) {
    sk_psock_unlink(sk, link);
    sk_psock_free_link(link);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-06-17 23:35    [W:4.046 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site