Daniel Borkmann e06fa9c16c bpf, sockmap: fix potential use after free in bpf_tcp_close ... bpf_tcp_close() we pop the psock linkage to a map via psock_map_pop(). A parallel update on the sock hash map can happen between psock_map_pop() and lookup_elem_raw() where we override the element under link->hash / link->key. In bpf_tcp_close()'s lookup_elem_raw() we subsequently only test whether an element is present, but we do not test whether the element is infact the element we were looking for. We lock the sock in bpf_tcp_close() during that time, so do we hold the lock in sock_hash_update_elem(). However, the latter locks the sock which is newly updated, not the one we're purging from the hash table. This means that while one CPU is doing the lookup from bpf_tcp_close(), another CPU is doing the map update in parallel, dropped our sock from the hlist and released the psock. Subsequently the first CPU will find the new sock and attempts to drop and release the old sock yet another time. Fix is that we need to check the elements for a match after lookup, similar as we do in the sock map. Note that the hash tab elems are freed via RCU, so access to their link->hash / link->key is fine since we're under RCU read side there. Fixes: e9db4ef6bf ("bpf: sockhash fix omitted bucket lock in sock_close") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2018-08-27 20:22:05 -07:00
..
bpf	bpf, sockmap: fix potential use after free in bpf_tcp_close	2018-08-27 20:22:05 -07:00
cgroup	Merge branch 'for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2018-08-24 13:19:27 -07:00
configs
debug
dma	kernel/dma: remove unsupported gfp_mask parameter from dma_alloc_from_contiguous()	2018-08-17 16:20:32 -07:00
events	treewide: convert ISO_8859-1 text comments to utf-8	2018-08-23 18:48:43 -07:00
gcov
irq	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 10:47:26 -07:00
livepatch	Merge branch 'for-4.19/upstream' into for-linus	2018-08-20 18:33:50 +02:00
locking	Updates for v4.19:	2018-08-20 18:32:00 -07:00
power	PM / sleep: wakeup: Fix build error caused by missing SRCU support	2018-08-15 00:07:08 +02:00
printk	fbdev changes for v4.19:	2018-08-23 15:44:58 -07:00
rcu	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sched	Merge branch 'akpm' (patches from Andrew)	2018-08-22 12:34:08 -07:00
time	Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2018-08-21 13:47:29 -07:00
trace	Masami found an off by one bug in the code that keeps "notrace" functions	2018-08-23 13:07:00 -07:00
.gitignore
acct.c
async.c
audit.c	audit: use ktime_get_coarse_real_ts64() for timestamps	2018-07-17 14:45:08 -04:00
audit.h
audit_fsnotify.c
audit_tree.c	\n	2018-08-17 09:41:28 -07:00
audit_watch.c	audit: fix use-after-free in audit_add_watch	2018-07-18 11:43:36 -04:00
auditfilter.c
auditsc.c	audit/stable-4.18 PR 20180814	2018-08-15 10:46:54 -07:00
backtracetest.c
bounds.c
capability.c
compat.c	time: Enable get/put_compat_itimerspec64 always	2018-06-24 14:39:47 +02:00
configs.c
context_tracking.c
cpu.c	cpu/hotplug: Non-SMP machines do not make use of booted_once	2018-08-14 15:00:00 -07:00
cpu_pm.c
crash_core.c	kernel/crash_core.c: print timestamp using time64_t	2018-08-22 10:52:47 -07:00
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c	signal: Pass pid type into group_send_sig_info	2018-07-21 12:57:35 -05:00
extable.c
fail_function.c
fork.c	Merge branch 'akpm' (patches from Andrew)	2018-08-22 12:34:08 -07:00
freezer.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
futex.c	futex: Mark expected switch fall-throughs	2018-08-20 18:23:00 +02:00
futex_compat.c
groups.c
hung_task.c	kernel/hung_task.c: allow to set checking interval separately from timeout	2018-08-22 10:52:47 -07:00
iomem.c
irq_work.c
jump_label.c
kallsyms.c	kallsyms, x86: Export addresses of PTI entry trampolines	2018-08-14 19:12:29 -03:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	kconfig: include kernel/Kconfig.preempt from init/Kconfig	2018-08-02 08:06:54 +09:00
kcov.c
kexec.c	kexec: add call to LSM hook in original kexec_load syscall	2018-07-16 12:31:57 -07:00
kexec_core.c
kexec_file.c
kexec_internal.h
kmod.c
kprobes.c
ksysfs.c
kthread.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
latencytop.c
Makefile	kbuild: move bin2c back to scripts/ from scripts/basic/	2018-07-18 01:18:05 +09:00
memremap.c	libnvdimm-for-4.19_dax-memory-failure	2018-08-25 18:43:59 -07:00
module-internal.h	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
module.c	module: use relative references for __ksymtab entries	2018-08-22 10:52:47 -07:00
module_signing.c	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
notifier.c
nsproxy.c
padata.c
panic.c
params.c
pid.c	pid: Implement PIDTYPE_TGID	2018-07-21 10:43:12 -05:00
pid_namespace.c
profile.c
ptrace.c
range.c
reboot.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
relay.c
resource.c
rseq.c	rseq: uapi: Declare rseq_cs field as union, update includes	2018-07-10 22:18:52 +02:00
seccomp.c
signal.c	Merge branch 'akpm' (patches from Andrew)	2018-08-22 12:34:08 -07:00
smp.c	cpu/hotplug: Fix SMT supported evaluation	2018-08-07 12:25:30 +02:00
smpboot.c	smpboot: Remove cpumask from the API	2018-07-03 09:20:44 +02:00
smpboot.h
softirq.c	nohz: Fix missing tick reprogram when interrupting an inline softirq	2018-08-03 15:52:10 +02:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sys.c	Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2018-08-24 09:25:39 -07:00
sys_ni.c
sysctl.c	namei: allow restricted O_CREAT of FIFOs and regular files	2018-08-23 18:48:43 -07:00
sysctl_binary.c
task_work.c
taskstats.c
test_kprobes.c
torture.c	torture: Keep old-school dmesg format	2018-06-25 11:30:10 -07:00
tracepoint.c	kernel: tracepoints: add support for relative references	2018-08-22 10:52:47 -07:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c	userns: use irqsave variant of refcount_dec_and_lock()	2018-08-22 10:52:47 -07:00
user_namespace.c	userns: move user access out of the mutex	2018-08-11 02:05:53 -05:00
utsname.c
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-08-11 02:05:53 -05:00
watchdog.c	watchdog/softlockup: Fix cpu_stop_queue_work() double-queue bug	2018-07-15 23:51:19 +02:00
watchdog_hld.c	watchdog: Reduce message verbosity	2018-08-03 12:19:08 +02:00
workqueue.c	Merge branch 'for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2018-08-24 13:16:36 -07:00
workqueue_internal.h