From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Liu Jian <liujian56@huawei.com>,
Alexei Starovoitov <ast@kernel.org>,
John Fastabend <john.fastabend@gmail.com>
Subject: [PATCH 5.10 36/77] tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function
Date: Mon, 1 Nov 2021 10:17:24 +0100 [thread overview]
Message-ID: <20211101082519.419310564@linuxfoundation.org> (raw)
In-Reply-To: <20211101082511.254155853@linuxfoundation.org>
From: Liu Jian <liujian56@huawei.com>
commit cd9733f5d75c94a32544d6ce5be47e14194cf137 upstream.
With two Msgs, msgA and msgB and a user doing nonblocking sendmsg calls (or
multiple cores) on a single socket 'sk' we could get the following flow.
msgA, sk msgB, sk
----------- ---------------
tcp_bpf_sendmsg()
lock(sk)
psock = sk->psock
tcp_bpf_sendmsg()
lock(sk) ... blocking
tcp_bpf_send_verdict
if (psock->eval == NONE)
psock->eval = sk_psock_msg_verdict
..
< handle SK_REDIRECT case >
release_sock(sk) < lock dropped so grab here >
ret = tcp_bpf_sendmsg_redir
psock = sk->psock
tcp_bpf_send_verdict
lock_sock(sk) ... blocking on B
if (psock->eval == NONE) <- boom.
psock->eval will have msgA state
The problem here is we dropped the lock on msgA and grabbed it with msgB.
Now we have old state in psock and importantly psock->eval has not been
cleared. So msgB will run whatever action was done on A and the verdict
program may never see it.
Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20211012052019.184398-1-liujian56@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_bpf.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -317,6 +317,7 @@ static int tcp_bpf_send_verdict(struct s
bool cork = false, enospc = sk_msg_full(msg);
struct sock *sk_redir;
u32 tosend, delta = 0;
+ u32 eval = __SK_NONE;
int ret;
more_data:
@@ -360,13 +361,24 @@ more_data:
case __SK_REDIRECT:
sk_redir = psock->sk_redir;
sk_msg_apply_bytes(psock, tosend);
+ if (!psock->apply_bytes) {
+ /* Clean up before releasing the sock lock. */
+ eval = psock->eval;
+ psock->eval = __SK_NONE;
+ psock->sk_redir = NULL;
+ }
if (psock->cork) {
cork = true;
psock->cork = NULL;
}
sk_msg_return(sk, msg, tosend);
release_sock(sk);
+
ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
+
+ if (eval == __SK_REDIRECT)
+ sock_put(sk_redir);
+
lock_sock(sk);
if (unlikely(ret < 0)) {
int free = sk_msg_free_nocharge(sk, msg);
next prev parent reply other threads:[~2021-11-01 9:37 UTC|newest]
Thread overview: 100+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-01 9:16 [PATCH 5.10 00/77] 5.10.77-rc1 review Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 01/77] ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images Greg Kroah-Hartman
2021-11-12 22:56 ` Florian Fainelli
2021-11-01 9:16 ` [PATCH 5.10 02/77] ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 03/77] ARM: 9134/1: remove duplicate memcpy() definition Greg Kroah-Hartman
2021-11-12 22:22 ` Pavel Machek
2021-11-01 9:16 ` [PATCH 5.10 04/77] ARM: 9138/1: fix link warning with XIP + frame-pointer Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 05/77] ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 06/77] ARM: 9141/1: only warn about XIP address when not compile testing Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 07/77] io_uring: dont take uring_lock during iowq cancel Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 08/77] powerpc/bpf: Fix BPF_MOD when imm == 1 Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 09/77] arm64: Avoid premature usercopy failure Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 10/77] ext4: fix possible UAF when remounting r/o a mmp-protected file system Greg Kroah-Hartman
2021-11-01 9:16 ` [PATCH 5.10 11/77] usbnet: sanity check for maxpacket Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 12/77] usbnet: fix error return code in usbnet_probe() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 13/77] Revert "pinctrl: bcm: ns: support updated DT binding as syscon subnode" Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 14/77] pinctrl: amd: disable and mask interrupts on probe Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 15/77] ata: sata_mv: Fix the error handling of mv_chip_id() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 16/77] tipc: fix size validations for the MSG_CRYPTO type Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 17/77] nfc: port100: fix using -ERRNO as command type mask Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 18/77] Revert "net: mdiobus: Fix memory leak in __mdiobus_register" Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 19/77] net/tls: Fix flipped sign in tls_err_abort() calls Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 20/77] mmc: vub300: fix control-message timeouts Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 21/77] mmc: cqhci: clear HALT state after CQE enable Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 22/77] mmc: mediatek: Move cqhci init behind ungate clock Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 23/77] mmc: dw_mmc: exynos: fix the finding clock sample value Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 24/77] mmc: sdhci: Map more voltage level to SDHCI_POWER_330 Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 25/77] mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 26/77] ocfs2: fix race between searching chunks and release journal_head from buffer_head Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 27/77] nvme-tcp: fix H2CData PDU send accounting (again) Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 28/77] cfg80211: scan: fix RCU in cfg80211_add_nontrans_list() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 29/77] cfg80211: fix management registrations locking Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 30/77] net: lan78xx: fix division by zero in send path Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 31/77] mm, thp: bail out early in collapse_file for writeback page Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 32/77] drm/ttm: fix memleak in ttm_transfered_destroy Greg Kroah-Hartman
2021-11-03 19:52 ` Sven Joachim
2021-11-03 20:29 ` [Nouveau] " Karol Herbst
2021-11-03 20:32 ` Karol Herbst
2021-11-03 20:47 ` Sven Joachim
2021-11-03 21:25 ` Karol Herbst
2021-11-04 7:39 ` Christian König
2021-11-04 8:44 ` Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 33/77] drm/amdgpu: fix out of bounds write Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 34/77] cgroup: Fix memory leak caused by missing cgroup_bpf_offline Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 35/77] riscv, bpf: Fix potential NULL dereference Greg Kroah-Hartman
2021-11-01 9:17 ` Greg Kroah-Hartman [this message]
2021-11-01 9:17 ` [PATCH 5.10 37/77] bpf: Fix potential race in tail call compatibility check Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 38/77] bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 39/77] IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 40/77] IB/hfi1: Fix abba locking issue with sc_disable() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 41/77] nvmet-tcp: fix data digest pointer calculation Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 42/77] nvme-tcp: " Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 43/77] nvme-tcp: fix possible req->offset corruption Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 44/77] octeontx2-af: Display all enabled PF VF rsrc_alloc entries Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 45/77] RDMA/mlx5: Set user priority for DCT Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 46/77] arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 47/77] reset: brcmstb-rescal: fix incorrect polarity of status bit Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 48/77] regmap: Fix possible double-free in regcache_rbtree_exit() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 49/77] net: batman-adv: fix error handling Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 50/77] net-sysfs: initialize uid and gid before calling net_ns_get_ownership Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 51/77] cfg80211: correct bridge/4addr mode check Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 52/77] net: Prevent infinite while loop in skb_tx_hash() Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 53/77] RDMA/sa_query: Use strscpy_pad instead of memcpy to copy a string Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 54/77] gpio: xgs-iproc: fix parsing of ngpios property Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 55/77] nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 56/77] mlxsw: pci: Recycle received packet upon allocation failure Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 57/77] net: ethernet: microchip: lan743x: Fix driver crash when lan743x_pm_resume fails Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 58/77] net: ethernet: microchip: lan743x: Fix dma allocation failure by using dma_set_mask_and_coherent Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 59/77] net: nxp: lpc_eth.c: avoid hang when bringing interface down Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 60/77] net/tls: Fix flipped sign in async_wait.err assignment Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 61/77] phy: phy_ethtool_ksettings_get: Lock the phy for consistency Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 62/77] phy: phy_ethtool_ksettings_set: Move after phy_start_aneg Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 63/77] phy: phy_start_aneg: Add an unlocked version Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 64/77] phy: phy_ethtool_ksettings_set: Lock the PHY while changing settings Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 65/77] sctp: use init_tag from inithdr for ABORT chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 66/77] sctp: fix the processing for INIT_ACK chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 67/77] sctp: fix the processing for COOKIE_ECHO chunk Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 68/77] sctp: add vtag check in sctp_sf_violation Greg Kroah-Hartman
2021-11-02 14:12 ` Alexey Khoroshilov
2021-11-02 15:52 ` Greg Kroah-Hartman
2021-11-08 6:57 ` Greg Kroah-Hartman
2021-11-08 7:23 ` Alexey Khoroshilov
2021-11-08 7:43 ` Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 69/77] sctp: add vtag check in sctp_sf_do_8_5_1_E_sa Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 70/77] sctp: add vtag check in sctp_sf_ootb Greg Kroah-Hartman
2021-11-01 9:17 ` [PATCH 5.10 71/77] lan743x: fix endianness when accessing descriptors Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 72/77] KVM: s390: clear kicked_mask before sleeping again Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 73/77] KVM: s390: preserve deliverable_mask in __airqs_kick_single_vcpu Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 74/77] scsi: ufs: ufs-exynos: Correct timeout value setting registers Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 75/77] riscv: fix misalgned trap vector base address Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 76/77] riscv: Fix asan-stack clang build Greg Kroah-Hartman
2021-11-01 9:18 ` [PATCH 5.10 77/77] perf script: Check session->header.env.arch before using it Greg Kroah-Hartman
2021-11-01 12:34 ` [PATCH 5.10 00/77] 5.10.77-rc1 review Fox Chen
2021-11-01 13:59 ` Jon Hunter
2021-11-01 21:21 ` Shuah Khan
2021-11-01 23:38 ` Guenter Roeck
2021-11-02 7:05 ` Naresh Kamboju
2021-11-02 12:12 ` Samuel Zou
2021-11-02 12:52 ` Sudip Mukherjee
2021-11-02 12:54 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211101082519.419310564@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ast@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=liujian56@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).