Files
linux/include/linux
Jakub Sitnicki 186bcc3dcd bpf: sockmap, restore sk_write_space when psock gets dropped
Once psock gets unlinked from its sock (sk_psock_drop), user-space can
still trigger a call to sk->sk_write_space by setting TCP_NOTSENT_LOWAT
socket option. This causes a null-ptr-deref because we try to read
psock->saved_write_space from sk_psock_write_space:

==================================================================
BUG: KASAN: null-ptr-deref in sk_psock_write_space+0x69/0x80
Read of size 8 at addr 00000000000001a0 by task sockmap-echo/131

CPU: 0 PID: 131 Comm: sockmap-echo Not tainted 5.2.0-rc1-00094-gf49aa1de9836 #81
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/2014
Call Trace:
 ? sk_psock_write_space+0x69/0x80
 __kasan_report.cold.2+0x5/0x3f
 ? sk_psock_write_space+0x69/0x80
 kasan_report+0xe/0x20
 sk_psock_write_space+0x69/0x80
 tcp_setsockopt+0x69a/0xfc0
 ? tcp_shutdown+0x70/0x70
 ? fsnotify+0x5b0/0x5f0
 ? remove_wait_queue+0x90/0x90
 ? __fget_light+0xa5/0xf0
 __sys_setsockopt+0xe6/0x180
 ? sockfd_lookup_light+0xb0/0xb0
 ? vfs_write+0x195/0x210
 ? ksys_write+0xc9/0x150
 ? __x64_sys_read+0x50/0x50
 ? __bpf_trace_x86_fpu+0x10/0x10
 __x64_sys_setsockopt+0x61/0x70
 do_syscall_64+0xc5/0x520
 ? vmacache_find+0xc0/0x110
 ? syscall_return_slowpath+0x110/0x110
 ? handle_mm_fault+0xb4/0x110
 ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
 ? trace_hardirqs_off_caller+0x4b/0x120
 ? trace_hardirqs_off_thunk+0x1a/0x3a
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2e5e7cdcce
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 66 2e 0f 1f 84 00 00 00 00 00
0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 8b 0d 8a 11 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffed011b778 EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2e5e7cdcce
RDX: 0000000000000019 RSI: 0000000000000006 RDI: 0000000000000007
RBP: 00007ffed011b790 R08: 0000000000000004 R09: 00007f2e5e84ee80
R10: 00007ffed011b788 R11: 0000000000000206 R12: 00007ffed011b78c
R13: 00007ffed011b788 R14: 0000000000000007 R15: 0000000000000068
==================================================================

Restore the saved sk_write_space callback when psock is being dropped to
fix the crash.

Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-05-23 16:13:29 +02:00
..
2018-11-14 10:56:33 -08:00
2018-11-12 10:33:49 +01:00
2019-05-02 10:37:55 +09:00
2019-04-15 18:14:01 -04:00
2019-05-14 19:52:50 -07:00
2018-11-07 13:44:59 -07:00
2018-11-07 13:44:59 -07:00
2019-04-23 01:50:43 +02:00
2019-04-09 17:05:46 -07:00
2019-05-07 08:39:02 -06:00
2019-04-19 11:26:48 -07:00
2019-05-09 15:25:13 -04:00
2018-11-13 21:55:24 +01:00
2019-02-28 03:28:53 -05:00
2019-02-28 08:24:23 -07:00
2018-12-19 10:42:08 +01:00
2019-03-12 10:04:02 -07:00
2019-04-22 09:48:12 -06:00
2019-02-15 16:54:38 +01:00
2019-03-09 19:52:47 -08:00
2018-11-07 13:42:32 -07:00
2019-03-22 14:36:02 +01:00
2019-05-01 07:47:37 -07:00
2018-11-19 19:03:46 -07:00
2019-04-08 22:56:14 +02:00
2018-12-06 13:57:03 +01:00
2018-11-30 13:29:04 +00:00
2019-03-07 18:32:03 -08:00
2019-01-30 20:51:47 -05:00
2019-04-19 14:07:40 -07:00
2019-02-20 07:22:17 -07:00
2019-02-20 07:22:10 -07:00
2018-12-06 15:45:46 +01:00
2019-02-08 15:02:49 -08:00
2019-03-05 21:07:19 -08:00
2019-05-14 09:47:51 -07:00
2019-05-07 14:31:03 +02:00
2019-03-12 10:04:03 -07:00
2019-05-14 19:52:51 -07:00
2019-05-14 19:52:48 -07:00
2018-12-03 17:11:02 -08:00
2019-04-02 17:57:35 +02:00
2019-05-08 22:14:36 +02:00
2019-05-16 15:51:55 -07:00
2019-03-15 15:29:47 -07:00
2019-02-07 16:38:35 +01:00
2019-02-07 00:13:27 +01:00
2018-12-10 10:17:45 +01:00
2019-04-06 10:48:35 -06:00
2019-05-01 08:38:47 -06:00
2019-01-11 18:05:40 -08:00
2019-04-30 12:37:51 +02:00
2019-05-15 17:35:54 +01:00
2019-04-09 15:14:49 -06:00
2018-12-22 12:15:29 +01:00