lkml.org 
[lkml]   [2020]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 079/203] bpf: skmsg, fix potential psock NULL pointer dereference
    Date
    From: John Fastabend <john.fastabend@gmail.com>

    commit 8163999db445021f2651a8a47b5632483e8722ea upstream.

    Report from Dan Carpenter,

    net/core/skmsg.c:792 sk_psock_write_space()
    error: we previously assumed 'psock' could be null (see line 790)

    net/core/skmsg.c
    789 psock = sk_psock(sk);
    790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
    Check for NULL
    791 schedule_work(&psock->work);
    792 write_space = psock->saved_write_space;
    ^^^^^^^^^^^^^^^^^^^^^^^^
    793 rcu_read_unlock();
    794 write_space(sk);

    Ensure psock dereference on line 792 only occurs if psock is not null.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/core/skmsg.c | 13 ++++++++-----
    1 file changed, 8 insertions(+), 5 deletions(-)

    --- a/net/core/skmsg.c
    +++ b/net/core/skmsg.c
    @@ -793,15 +793,18 @@ static void sk_psock_strp_data_ready(str
    static void sk_psock_write_space(struct sock *sk)
    {
    struct sk_psock *psock;
    - void (*write_space)(struct sock *sk);
    + void (*write_space)(struct sock *sk) = NULL;

    rcu_read_lock();
    psock = sk_psock(sk);
    - if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
    - schedule_work(&psock->work);
    - write_space = psock->saved_write_space;
    + if (likely(psock)) {
    + if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
    + schedule_work(&psock->work);
    + write_space = psock->saved_write_space;
    + }
    rcu_read_unlock();
    - write_space(sk);
    + if (write_space)
    + write_space(sk);
    }

    int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)

    \
     
     \ /
      Last update: 2020-01-17 00:47    [W:4.993 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site