Daniel Borkmann e06fa9c16c bpf, sockmap: fix potential use after free in bpf_tcp_close ... bpf_tcp_close() we pop the psock linkage to a map via psock_map_pop(). A parallel update on the sock hash map can happen between psock_map_pop() and lookup_elem_raw() where we override the element under link->hash / link->key. In bpf_tcp_close()'s lookup_elem_raw() we subsequently only test whether an element is present, but we do not test whether the element is infact the element we were looking for. We lock the sock in bpf_tcp_close() during that time, so do we hold the lock in sock_hash_update_elem(). However, the latter locks the sock which is newly updated, not the one we're purging from the hash table. This means that while one CPU is doing the lookup from bpf_tcp_close(), another CPU is doing the map update in parallel, dropped our sock from the hlist and released the psock. Subsequently the first CPU will find the new sock and attempts to drop and release the old sock yet another time. Fix is that we need to check the elements for a match after lookup, similar as we do in the sock map. Note that the hash tab elems are freed via RCU, so access to their link->hash / link->key is fine since we're under RCU read side there. Fixes: e9db4ef6bf ("bpf: sockhash fix omitted bucket lock in sock_close") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2018-08-27 20:22:05 -07:00
..
arraymap.c
bpf_lru_list.c
bpf_lru_list.h
btf.c
cgroup.c
core.c	bpf: fix a rcu usage warning in bpf_prog_array_copy_core()	2018-08-16 21:55:32 +02:00
cpumap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
devmap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
disasm.c
disasm.h
hashtab.c	bpf: use per htab salt for bucket hash	2018-08-23 18:45:47 +02:00
helpers.c
inode.c
local_storage.c
lpm_trie.c
Makefile
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
reuseport_array.c
sockmap.c	bpf, sockmap: fix potential use after free in bpf_tcp_close	2018-08-27 20:22:05 -07:00
stackmap.c
syscall.c
tnum.c
verifier.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
xskmap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00