John Fastabend 9617456054 bpf: parse and verdict prog attach may race with bpf map update ... In the sockmap design BPF programs (SK_SKB_STREAM_PARSER, SK_SKB_STREAM_VERDICT and SK_MSG_VERDICT) are attached to the sockmap map type and when a sock is added to the map the programs are used by the socket. However, sockmap updates from both userspace and BPF programs can happen concurrently with the attach and detach of these programs. To resolve this we use the bpf_prog_inc_not_zero and a READ_ONCE() primitive to ensure the program pointer is not refeched and possibly NULL'd before the refcnt increment. This happens inside a RCU critical section so although the pointer reference in the map object may be NULL (by a concurrent detach operation) the reference from READ_ONCE will not be free'd until after grace period. This ensures the object returned by READ_ONCE() is valid through the RCU criticl section and safe to use as long as we "know" it may be free'd shortly. Daniel spotted a case in the sock update API where instead of using the READ_ONCE() program reference we used the pointer from the original map, stab->bpf_{verdict|parse|txmsg}. The problem with this is the logic checks the object returned from the READ_ONCE() is not NULL and then tries to reference the object again but using the above map pointer, which may have already been NULL'd by a parallel detach operation. If this happened bpf_porg_inc_not_zero could dereference a NULL pointer. Fix this by using variable returned by READ_ONCE() that is checked for NULL. Fixes: 2f857d0460 ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support") Reported-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2018-05-18 00:27:37 +02:00
..
arraymap.c	bpf: sockmap, map_release does not hold refcnt for pinned maps	2018-04-24 00:49:45 +02:00
bpf_lru_list.c	bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4	2017-04-17 13:55:52 -04:00
bpf_lru_list.h	bpf: Only set node->ref = 1 if it has not been set	2017-09-01 09:57:39 -07:00
cgroup.c	bpf: Hooks for sys_bind	2018-03-31 02:15:18 +02:00
core.c	bpf/tracing: fix a deadlock in perf_event_detach_bpf_prog	2018-04-11 01:01:40 +02:00
cpumap.c	bpf: cpumap: use GFP_KERNEL instead of GFP_ATOMIC in __cpu_map_entry_alloc()	2018-02-14 15:34:27 +01:00
devmap.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
disasm.c	bpf: Remove struct bpf_verifier_env argument from print_bpf_insn	2018-03-23 17:38:57 +01:00
disasm.h	bpf: Remove struct bpf_verifier_env argument from print_bpf_insn	2018-03-23 17:38:57 +01:00
hashtab.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
helpers.c	bpf: rename ARG_PTR_TO_STACK	2017-01-09 16:56:27 -05:00
inode.c	bpf: comment why dots in filenames under BPF virtual FS are not allowed	2018-03-09 10:30:30 +01:00
lpm_trie.c	bpf: fix rcu lockdep warning for lpm_trie map_free callback	2018-02-22 21:29:12 +01:00
Makefile	bpf: only build sockmap with CONFIG_INET	2018-01-04 19:01:14 +01:00
map_in_map.c	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
map_in_map.h	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
offload.c	bpf: offload: report device information about offloaded maps	2018-01-18 22:54:25 +01:00
percpu_freelist.c	bpf: fix lockdep splat	2017-11-15 19:46:32 +09:00
percpu_freelist.h
sockmap.c	bpf: parse and verdict prog attach may race with bpf map update	2018-05-18 00:27:37 +02:00
stackmap.c	bpf: extend stackmap to save binary_build_id+offset instead of address	2018-03-15 01:09:28 +01:00
syscall.c	bpf: use array_index_nospec in find_prog_type	2018-05-03 19:29:35 -07:00
tnum.c	bpf/verifier: track signed and unsigned min/max values	2017-08-08 17:51:34 -07:00
verifier.c	bpf: Hooks for sys_bind	2018-03-31 02:15:18 +02:00