syzbot reported the following NULL pointer dereference issue [1]:
BUG: kernel NULL pointer dereference, address: 0000000000000000
..
RIP: 0010:0x0
..
Call Trace:
<TASK>
sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230
unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:745
____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
If sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called
concurrently, psock->saved_data_ready can be NULL, causing the above issue.
This patch fixes this issue by calling the appropriate data ready function
using the sk_psock_data_ready() helper and protecting it from concurrency
with sk->sk_callback_lock.
Fixes: 6df7f764cd3c ("bpf, sockmap: Wake up polling after data copy")
Reported-and-tested-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=fd7b34375c1c8ce29c93 [1]
Signed-off-by: Shigeru Yoshida <[email protected]>
---
net/core/skmsg.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 93ecfceac1bc..4d75ef9d24bf 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -1226,8 +1226,11 @@ static void sk_psock_verdict_data_ready(struct sock *sk)
rcu_read_lock();
psock = sk_psock(sk);
- if (psock)
- psock->saved_data_ready(sk);
+ if (psock) {
+ read_lock_bh(&sk->sk_callback_lock);
+ sk_psock_data_ready(sk, psock);
+ read_unlock_bh(&sk->sk_callback_lock);
+ }
rcu_read_unlock();
}
}
--
2.43.0
Shigeru Yoshida wrote:
> syzbot reported the following NULL pointer dereference issue [1]:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> RIP: 0010:0x0
> ...
> Call Trace:
> <TASK>
> sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230
> unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
> ___sys_sendmsg net/socket.c:2638 [inline]
> __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
> do_syscall_64+0xf9/0x240
> entry_SYSCALL_64_after_hwframe+0x6f/0x77
>
> If sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called
> concurrently, psock->saved_data_ready can be NULL, causing the above issue.
>
> This patch fixes this issue by calling the appropriate data ready function
> using the sk_psock_data_ready() helper and protecting it from concurrency
> with sk->sk_callback_lock.
>
> Fixes: 6df7f764cd3c ("bpf, sockmap: Wake up polling after data copy")
> Reported-and-tested-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=fd7b34375c1c8ce29c93 [1]
> Signed-off-by: Shigeru Yoshida <[email protected]>
> ---
By ensuring order of ops on teardown we should never have a loop here. Also
this aligns with strp usage that also uses sk_callback_lock. Thanks. I
suspect we haven't seen it because when this is being used we never remove
socks from the map before the socket is released.
Acked-by: John Fastabend <[email protected]>
> net/core/skmsg.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 93ecfceac1bc..4d75ef9d24bf 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -1226,8 +1226,11 @@ static void sk_psock_verdict_data_ready(struct sock *sk)
>
> rcu_read_lock();
> psock = sk_psock(sk);
> - if (psock)
> - psock->saved_data_ready(sk);
> + if (psock) {
> + read_lock_bh(&sk->sk_callback_lock);
> + sk_psock_data_ready(sk, psock);
> + read_unlock_bh(&sk->sk_callback_lock);
> + }
> rcu_read_unlock();
> }
> }
> --
> 2.43.0
>
Hello:
This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann <[email protected]>:
On Mon, 19 Feb 2024 00:09:33 +0900 you wrote:
> syzbot reported the following NULL pointer dereference issue [1]:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> RIP: 0010:0x0
> ...
> Call Trace:
> <TASK>
> sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230
> unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293
> sock_sendmsg_nosec net/socket.c:730 [inline]
> __sock_sendmsg+0x221/0x270 net/socket.c:745
> ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
> ___sys_sendmsg net/socket.c:2638 [inline]
> __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
> do_syscall_64+0xf9/0x240
> entry_SYSCALL_64_after_hwframe+0x6f/0x77
>
> [...]
Here is the summary with links:
- [bpf] bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()
https://git.kernel.org/bpf/bpf/c/4cd12c6065df
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html