Commit 50f9c2ee authored May 21, 2022 by Cong Wang Committed by Zheng Zengkai May 21, 2022

sock_map: Fix a potential use-after-free in sock_map_close()

mainline inclusion
from mainline-v5.13-rc1
commit aadb2bb8
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I545NW

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aadb2bb83ff789de63b48b4edeab7329423a50d3



--------------------------------

The last refcnt of the psock can be gone right after
sock_map_remove_links(), so sk_psock_stop() could trigger a UAF.
The reason why I placed sk_psock_stop() there is to avoid RCU read
critical section, and more importantly, some callee of
sock_map_remove_links() is supposed to be called with RCU read lock,
we can not simply get rid of RCU read lock here. Therefore, the only
choice we have is to grab an additional refcnt with sk_psock_get()
and put it back after sk_psock_stop().

Fixes: 799aa7f9 ("skmsg: Avoid lock_sock() in sk_psock_backlog()")
Reported-by:  <syzbot+7b6548ae483d6f4c64ae@syzkaller.appspotmail.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20210408030556.45134-1-xiyou.wangcong@gmail.com


Signed-off-by: Wang Yufen <wangyufen@huawei.com>
Reviewed-by: Yue Haibing <yuehaibing@huawei.com>
Reviewed-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>

parent ca64f3e4

net/core/sock_map.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1549,7 +1549,7 @@ void sock_map_close(struct sock *sk, long timeout)

		lock_sock(sk);
		rcu_read_lock();
		psock = sk_psock(sk);
		psock = sk_psock_get(sk);
		if (unlikely(!psock)) {
		rcu_read_unlock();
		release_sock(sk);
		@@ -1560,6 +1560,7 @@ void sock_map_close(struct sock *sk, long timeout)
		sock_map_remove_links(sk, psock);
		rcu_read_unlock();
		sk_psock_stop(psock, true);
		sk_psock_put(sk, psock);
		release_sock(sk);
		saved_close(sk, timeout);
		}