* [bpf PATCH v2] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
@ 2018-08-31 4:25 John Fastabend
2018-09-02 20:40 ` Daniel Borkmann
0 siblings, 1 reply; 2+ messages in thread
From: John Fastabend @ 2018-08-31 4:25 UTC (permalink / raw)
To: ast, daniel; +Cc: netdev
Currently we check sk_user_data is non NULL to determine if the sk
exists in a map. However, this is not sufficient to ensure the psock
or the ULP ops are not in use by another user, such as kcm or TLS. To
avoid this when adding a sock to a map also verify it is of the
correct ULP type. Additionally, when releasing a psock verify that
it is the TCP_ULP_BPF type before releasing the ULP. The error case
where we abort an update due to ULP collision can cause this error
path.
For example,
__sock_map_ctx_update_elem()
[...]
err = tcp_set_ulp_id(sock, TCP_ULP_BPF) <- collides with TLS
if (err) <- so err out here
goto out_free
[...]
out_free:
smap_release_sock() <- calling tcp_cleanup_ulp releases the
TLS ULP incorrectly.
Fixes: 2f857d04601a ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
---
kernel/bpf/sockmap.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index ce63e58..488ef96 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1462,10 +1462,16 @@ static void smap_destroy_psock(struct rcu_head *rcu)
schedule_work(&psock->gc_work);
}
+static bool psock_is_smap_sk(struct sock *sk)
+{
+ return inet_csk(sk)->icsk_ulp_ops == &bpf_tcp_ulp_ops;
+}
+
static void smap_release_sock(struct smap_psock *psock, struct sock *sock)
{
if (refcount_dec_and_test(&psock->refcnt)) {
- tcp_cleanup_ulp(sock);
+ if (psock_is_smap_sk(sock))
+ tcp_cleanup_ulp(sock);
write_lock_bh(&sock->sk_callback_lock);
smap_stop_sock(psock, sock);
write_unlock_bh(&sock->sk_callback_lock);
@@ -1892,6 +1898,10 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
* doesn't update user data.
*/
if (psock) {
+ if (!psock_is_smap_sk(sock)) {
+ err = -EBUSY;
+ goto out_progs;
+ }
if (READ_ONCE(psock->bpf_parse) && parse) {
err = -EBUSY;
goto out_progs;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [bpf PATCH v2] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
2018-08-31 4:25 [bpf PATCH v2] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP John Fastabend
@ 2018-09-02 20:40 ` Daniel Borkmann
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Borkmann @ 2018-09-02 20:40 UTC (permalink / raw)
To: John Fastabend, ast; +Cc: netdev
On 08/31/2018 06:25 AM, John Fastabend wrote:
> Currently we check sk_user_data is non NULL to determine if the sk
> exists in a map. However, this is not sufficient to ensure the psock
> or the ULP ops are not in use by another user, such as kcm or TLS. To
> avoid this when adding a sock to a map also verify it is of the
> correct ULP type. Additionally, when releasing a psock verify that
> it is the TCP_ULP_BPF type before releasing the ULP. The error case
> where we abort an update due to ULP collision can cause this error
> path.
>
> For example,
>
> __sock_map_ctx_update_elem()
> [...]
> err = tcp_set_ulp_id(sock, TCP_ULP_BPF) <- collides with TLS
> if (err) <- so err out here
> goto out_free
> [...]
> out_free:
> smap_release_sock() <- calling tcp_cleanup_ulp releases the
> TLS ULP incorrectly.
>
> Fixes: 2f857d04601a ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support")
> Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Applied to bpf, thanks John!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-09-03 0:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-31 4:25 [bpf PATCH v2] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP John Fastabend
2018-09-02 20:40 ` Daniel Borkmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.