Received-SPF: pass (google.com: domain of linux-kernel+bounces-74204-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Tue, 20 Feb 2024 23:18:35 -0800
From: John Fastabend <john.fastabend@gmail.com>
To: Shigeru Yoshida <syoshida@redhat.com>, 
 john.fastabend@gmail.com, 
 jakub@cloudflare.com
Cc: davem@davemloft.net, 
 edumazet@google.com, 
 pabeni@redhat.com, 
 netdev@vger.kernel.org, 
 bpf@vger.kernel.org, 
 linux-kernel@vger.kernel.org, 
 Shigeru Yoshida <syoshida@redhat.com>, 
 syzbot+fd7b34375c1c8ce29c93@syzkaller.appspotmail.com
Message-ID: <65d5a3cbac150_5fc5920879@john.notmuch>
In-Reply-To: <20240218150933.6004-1-syoshida@redhat.com>
References: <20240218150933.6004-1-syoshida@redhat.com>
Subject: RE: [PATCH bpf] bpf, sockmap: Fix NULL pointer dereference in
 sk_psock_verdict_data_ready()
Precedence: bulk
Mime-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: 7bit

Shigeru Yoshida wrote:
> syzbot reported the following NULL pointer dereference issue [1]:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> RIP: 0010:0x0
> ...
> Call Trace:
>  <TASK>
>  sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230
>  unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293
>  sock_sendmsg_nosec net/socket.c:730 [inline]
>  __sock_sendmsg+0x221/0x270 net/socket.c:745
>  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
>  ___sys_sendmsg net/socket.c:2638 [inline]
>  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
>  do_syscall_64+0xf9/0x240
>  entry_SYSCALL_64_after_hwframe+0x6f/0x77
> 
> If sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called
> concurrently, psock->saved_data_ready can be NULL, causing the above issue.
> 
> This patch fixes this issue by calling the appropriate data ready function
> using the sk_psock_data_ready() helper and protecting it from concurrency
> with sk->sk_callback_lock.
> 
> Fixes: 6df7f764cd3c ("bpf, sockmap: Wake up polling after data copy")
> Reported-and-tested-by: syzbot+fd7b34375c1c8ce29c93@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fd7b34375c1c8ce29c93 [1]
> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
> ---

By ensuring order of ops on teardown we should never have a loop here. Also
this aligns with strp usage that also uses sk_callback_lock. Thanks. I
suspect we haven't seen it because when this is being used we never remove
socks from the map before the socket is released.

Acked-by: John Fastabend <john.fastabend@gmail.com>

>  net/core/skmsg.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/skmsg.c b/net/core/skmsg.c
> index 93ecfceac1bc..4d75ef9d24bf 100644
> --- a/net/core/skmsg.c
> +++ b/net/core/skmsg.c
> @@ -1226,8 +1226,11 @@ static void sk_psock_verdict_data_ready(struct sock *sk)
>  
>  		rcu_read_lock();
>  		psock = sk_psock(sk);
> -		if (psock)
> -			psock->saved_data_ready(sk);
> +		if (psock) {
> +			read_lock_bh(&sk->sk_callback_lock);
> +			sk_psock_data_ready(sk, psock);
> +			read_unlock_bh(&sk->sk_callback_lock);
> +		}
>  		rcu_read_unlock();
>  	}
>  }
> -- 
> 2.43.0
>