Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 13 Aug 2019 11:59:48 -0700
From:   Jakub Kicinski <jakub.kicinski@netronome.com>
To:     John Fastabend <john.fastabend@gmail.com>
Cc:     Hillf Danton <hdanton@sina.com>,
        syzbot <syzbot+dcdc9deefaec44785f32@syzkaller.appspotmail.com>,
        aviadye@mellanox.com, borisp@mellanox.com, daniel@iogearbox.net,
        davejwatson@fb.com, davem@davemloft.net,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        oss-drivers@netronome.com, syzkaller-bugs@googlegroups.com,
        willemb@google.com
Subject: Re: general protection fault in tls_write_space
Message-ID: <20190813115948.5f57b272@cakuba.netronome.com>
In-Reply-To: <5d5301a82578_268d2b12c8efa5b470@john-XPS-13-9370.notmuch>
References: <000000000000f5d619058faea744@google.com>
        <20190810135900.2820-1-hdanton@sina.com>
        <5d52f09299e91_40c72adb748b25c0d3@john-XPS-13-9370.notmuch>
        <20190813102705.1f312b67@cakuba.netronome.com>
        <5d5301a82578_268d2b12c8efa5b470@john-XPS-13-9370.notmuch>
Organization: Netronome Systems, Ltd.
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, 13 Aug 2019 11:30:00 -0700, John Fastabend wrote:
> Jakub Kicinski wrote:
> > On Tue, 13 Aug 2019 10:17:06 -0700, John Fastabend wrote:  
> > > > Followup of commit 95fa145479fb
> > > > ("bpf: sockmap/tls, close can race with map free")
> > > > 
> > > > --- a/net/tls/tls_main.c
> > > > +++ b/net/tls/tls_main.c
> > > > @@ -308,6 +308,9 @@ static void tls_sk_proto_close(struct so
> > > >  	if (free_ctx)
> > > >  		icsk->icsk_ulp_data = NULL;
> > > >  	sk->sk_prot = ctx->sk_proto;
> > > > +	/* tls will go; restore sock callback before enabling bh */
> > > > +	if (sk->sk_write_space == tls_write_space)
> > > > +		sk->sk_write_space = ctx->sk_write_space;
> > > >  	write_unlock_bh(&sk->sk_callback_lock);
> > > >  	release_sock(sk);
> > > >  	if (ctx->tx_conf == TLS_SW)    
> > > 
> > > Hi Hillf,
> > > 
> > > We need this patch (although slightly updated for bpf tree) do
> > > you want to send it? Otherwise I can. We should only set this if
> > > TX path was enabled otherwise we null it. Checking against
> > > tls_write_space seems best to me as well.
> > > 
> > > Against bpf this patch should fix it.
> > > 
> > > diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
> > > index ce6ef56a65ef..43252a801c3f 100644
> > > --- a/net/tls/tls_main.c
> > > +++ b/net/tls/tls_main.c
> > > @@ -308,7 +308,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
> > >         if (free_ctx)
> > >                 icsk->icsk_ulp_data = NULL;
> > >         sk->sk_prot = ctx->sk_proto;
> > > -       sk->sk_write_space = ctx->sk_write_space;
> > > +       if (sk->sk_write_space == tls_write_space)
> > > +               sk->sk_write_space = ctx->sk_write_space;
> > >         write_unlock_bh(&sk->sk_callback_lock);
> > >         release_sock(sk);
> > >         if (ctx->tx_conf == TLS_SW)  
> > 
> > This is already in net since Friday:  
> 
> Don't we need to guard that with an
> 
>   if (sk->sk_write_space == tls_write_space)
> 
> or something similar? Where is ctx->sk_write_space set in the rx only
> case? In do_tls_setsockop_conf() we have this block
> 
> 	if (tx) {
> 		ctx->sk_write_space = sk->sk_write_space;
> 		sk->sk_write_space = tls_write_space;
> 	} else {
> 		sk->sk_socket->ops = &tls_sw_proto_ops;
> 	}
> 
> which makes me think ctx->sk_write_space may not be set correctly in
> all cases.

Ah damn, you're right I remember looking at that but then I went down
the rabbit hole of trying to repro and forgot :/

Do you want to send an incremental change?