From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
To: Martin Lau <kafai@fb.com>
Cc: Lorenz Bauer <lmb@cloudflare.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
"David S. Miller" <davem@davemloft.net>,
Joe Stringer <joe@isovalent.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"bpf@vger.kernel.org" <bpf@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"kernel-team@cloudflare.com" <kernel-team@cloudflare.com>
Subject: Re: [PATCH bpf v2] net: bpf: don't leak time wait and request sockets
Date: Fri, 10 Jan 2020 10:45:53 -0800 [thread overview]
Message-ID: <CAADnVQ+QhS-qCNQt7Gs2tQo=mxj7cKOk-zwzdTyBLHwy6u7aiw@mail.gmail.com> (raw)
In-Reply-To: <20200110164328.aosamgjk5hfw7r7d@kafai-mbp.dhcp.thefacebook.com>
On Fri, Jan 10, 2020 at 8:43 AM Martin Lau <kafai@fb.com> wrote:
>
> On Fri, Jan 10, 2020 at 01:23:36PM +0000, Lorenz Bauer wrote:
> > It's possible to leak time wait and request sockets via the following
> > BPF pseudo code:
> >
> > sk = bpf_skc_lookup_tcp(...)
> > if (sk)
> > bpf_sk_release(sk)
> >
> > If sk->sk_state is TCP_NEW_SYN_RECV or TCP_TIME_WAIT the refcount taken
> > by bpf_skc_lookup_tcp is not undone by bpf_sk_release. This is because
> > sk_flags is re-used for other data in both kinds of sockets. The check
> >
> > !sock_flag(sk, SOCK_RCU_FREE)
> >
> > therefore returns a bogus result. Check that sk_flags is valid by calling
> > sk_fullsock. Skip checking SOCK_RCU_FREE if we already know that sk is
> > not a full socket.
> Acked-by: Martin KaFai Lau <kafai@fb.com>
Applied. Thanks
prev parent reply other threads:[~2020-01-10 18:46 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-09 11:57 [PATCH bpf 0/1] Fix memory leak in helpers dealing with sockets Lorenz Bauer
2020-01-09 11:57 ` [PATCH bpf 1/1] net: bpf: don't leak time wait and request sockets Lorenz Bauer
2020-01-09 18:23 ` Martin Lau
2020-01-10 13:27 ` Lorenz Bauer
2020-01-10 13:23 ` [PATCH bpf v2] " Lorenz Bauer
2020-01-10 16:43 ` Martin Lau
2020-01-10 18:45 ` Alexei Starovoitov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAADnVQ+QhS-qCNQt7Gs2tQo=mxj7cKOk-zwzdTyBLHwy6u7aiw@mail.gmail.com' \
--to=alexei.starovoitov@gmail.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=joe@isovalent.com \
--cc=kafai@fb.com \
--cc=kernel-team@cloudflare.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lmb@cloudflare.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.