BPF Archive on lore.kernel.org
 help / Atom feed
* [bpf PATCH] bpf: sockmap, restore sk_write_space when psock gets dropped
@ 2019-05-22 10:01 Jakub Sitnicki
  2019-05-23 14:15 ` Daniel Borkmann
  0 siblings, 1 reply; 2+ messages in thread
From: Jakub Sitnicki @ 2019-05-22 10:01 UTC (permalink / raw)
  To: Daniel Borkmann, John Fastabend; +Cc: netdev, bpf, kernel-team

Once psock gets unlinked from its sock (sk_psock_drop), user-space can
still trigger a call to sk->sk_write_space by setting TCP_NOTSENT_LOWAT
socket option. This causes a null-ptr-deref because we try to read
psock->saved_write_space from sk_psock_write_space:

==================================================================
BUG: KASAN: null-ptr-deref in sk_psock_write_space+0x69/0x80
Read of size 8 at addr 00000000000001a0 by task sockmap-echo/131

CPU: 0 PID: 131 Comm: sockmap-echo Not tainted 5.2.0-rc1-00094-gf49aa1de9836 #81
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/2014
Call Trace:
 ? sk_psock_write_space+0x69/0x80
 __kasan_report.cold.2+0x5/0x3f
 ? sk_psock_write_space+0x69/0x80
 kasan_report+0xe/0x20
 sk_psock_write_space+0x69/0x80
 tcp_setsockopt+0x69a/0xfc0
 ? tcp_shutdown+0x70/0x70
 ? fsnotify+0x5b0/0x5f0
 ? remove_wait_queue+0x90/0x90
 ? __fget_light+0xa5/0xf0
 __sys_setsockopt+0xe6/0x180
 ? sockfd_lookup_light+0xb0/0xb0
 ? vfs_write+0x195/0x210
 ? ksys_write+0xc9/0x150
 ? __x64_sys_read+0x50/0x50
 ? __bpf_trace_x86_fpu+0x10/0x10
 __x64_sys_setsockopt+0x61/0x70
 do_syscall_64+0xc5/0x520
 ? vmacache_find+0xc0/0x110
 ? syscall_return_slowpath+0x110/0x110
 ? handle_mm_fault+0xb4/0x110
 ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
 ? trace_hardirqs_off_caller+0x4b/0x120
 ? trace_hardirqs_off_thunk+0x1a/0x3a
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f2e5e7cdcce
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 66 2e 0f 1f 84 00 00 00 00 00
0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 8b 0d 8a 11 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffed011b778 EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2e5e7cdcce
RDX: 0000000000000019 RSI: 0000000000000006 RDI: 0000000000000007
RBP: 00007ffed011b790 R08: 0000000000000004 R09: 00007f2e5e84ee80
R10: 00007ffed011b788 R11: 0000000000000206 R12: 00007ffed011b78c
R13: 00007ffed011b788 R14: 0000000000000007 R15: 0000000000000068
==================================================================

Restore the saved sk_write_space callback when psock is being dropped to
fix the crash.

Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
---
 include/linux/skmsg.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index 178a3933a71b..50ced8aba9db 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -351,6 +351,8 @@ static inline void sk_psock_update_proto(struct sock *sk,
 static inline void sk_psock_restore_proto(struct sock *sk,
 					  struct sk_psock *psock)
 {
+	sk->sk_write_space = psock->saved_write_space;
+
 	if (psock->sk_proto) {
 		sk->sk_prot = psock->sk_proto;
 		psock->sk_proto = NULL;
-- 
2.20.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [bpf PATCH] bpf: sockmap, restore sk_write_space when psock gets dropped
  2019-05-22 10:01 [bpf PATCH] bpf: sockmap, restore sk_write_space when psock gets dropped Jakub Sitnicki
@ 2019-05-23 14:15 ` Daniel Borkmann
  0 siblings, 0 replies; 2+ messages in thread
From: Daniel Borkmann @ 2019-05-23 14:15 UTC (permalink / raw)
  To: Jakub Sitnicki, John Fastabend; +Cc: netdev, bpf, kernel-team

On 05/22/2019 12:01 PM, Jakub Sitnicki wrote:
> Once psock gets unlinked from its sock (sk_psock_drop), user-space can
> still trigger a call to sk->sk_write_space by setting TCP_NOTSENT_LOWAT
> socket option. This causes a null-ptr-deref because we try to read
> psock->saved_write_space from sk_psock_write_space:
> 
> ==================================================================
> BUG: KASAN: null-ptr-deref in sk_psock_write_space+0x69/0x80
> Read of size 8 at addr 00000000000001a0 by task sockmap-echo/131
> 
> CPU: 0 PID: 131 Comm: sockmap-echo Not tainted 5.2.0-rc1-00094-gf49aa1de9836 #81
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> ?-20180724_192412-buildhw-07.phx2.fedoraproject.org-1.fc29 04/01/2014
> Call Trace:
>  ? sk_psock_write_space+0x69/0x80
>  __kasan_report.cold.2+0x5/0x3f
>  ? sk_psock_write_space+0x69/0x80
>  kasan_report+0xe/0x20
>  sk_psock_write_space+0x69/0x80
>  tcp_setsockopt+0x69a/0xfc0
>  ? tcp_shutdown+0x70/0x70
>  ? fsnotify+0x5b0/0x5f0
>  ? remove_wait_queue+0x90/0x90
>  ? __fget_light+0xa5/0xf0
>  __sys_setsockopt+0xe6/0x180
>  ? sockfd_lookup_light+0xb0/0xb0
>  ? vfs_write+0x195/0x210
>  ? ksys_write+0xc9/0x150
>  ? __x64_sys_read+0x50/0x50
>  ? __bpf_trace_x86_fpu+0x10/0x10
>  __x64_sys_setsockopt+0x61/0x70
>  do_syscall_64+0xc5/0x520
>  ? vmacache_find+0xc0/0x110
>  ? syscall_return_slowpath+0x110/0x110
>  ? handle_mm_fault+0xb4/0x110
>  ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe
>  ? trace_hardirqs_off_caller+0x4b/0x120
>  ? trace_hardirqs_off_thunk+0x1a/0x3a
>  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x7f2e5e7cdcce
> Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b1 66 2e 0f 1f 84 00 00 00 00 00
> 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff
> ff 73 01 c3 48 8b 0d 8a 11 0c 00 f7 d8 64 89 01 48
> RSP: 002b:00007ffed011b778 EFLAGS: 00000206 ORIG_RAX: 0000000000000036
> RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2e5e7cdcce
> RDX: 0000000000000019 RSI: 0000000000000006 RDI: 0000000000000007
> RBP: 00007ffed011b790 R08: 0000000000000004 R09: 00007f2e5e84ee80
> R10: 00007ffed011b788 R11: 0000000000000206 R12: 00007ffed011b78c
> R13: 00007ffed011b788 R14: 0000000000000007 R15: 0000000000000068
> ==================================================================
> 
> Restore the saved sk_write_space callback when psock is being dropped to
> fix the crash.
> 
> Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>

LGTM, applied thanks!

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-22 10:01 [bpf PATCH] bpf: sockmap, restore sk_write_space when psock gets dropped Jakub Sitnicki
2019-05-23 14:15 ` Daniel Borkmann

BPF Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/bpf/0 bpf/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 bpf bpf/ https://lore.kernel.org/bpf \
		bpf@vger.kernel.org bpf@archiver.kernel.org
	public-inbox-index bpf


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.bpf


AGPL code for this site: git clone https://public-inbox.org/ public-inbox