Commit 563a7498 authored by Eric Dumazet's avatar Eric Dumazet Committed by Liu Jian
Browse files

sock_map: Add a cond_resched() in sock_hash_free() 

stable inclusion
from stable-v5.10.227
commit 1a11a1a53255ddab8a903cdae01b9d3eb2c1a47b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKH
CVE: CVE-2024-47710

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1a11a1a53255ddab8a903cdae01b9d3eb2c1a47b



-------------------------------------------------

[ Upstream commit b1339be951ad31947ae19bc25cb08769bf255100 ]

Several syzbot soft lockup reports all have in common sock_hash_free()

If a map with a large number of buckets is destroyed, we need to yield
the cpu when needed.

Fixes: 75e68e5b ("bpf, sockhash: Synchronize delete from bucket list on map free")
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20240906154449.3742932-1-edumazet@google.com


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 2f1dfb23

net/core/sock_map.c

+1 −0
Original line number Diff line number Diff line
@@ -1225,6 +1225,7 @@ static void sock_hash_free(struct bpf_map *map) 
			sock_put(elem->sk);

			sock_hash_free_elem(htab, elem);

		}

		cond_resched();

	}



	/* wait for psock readers accessing its map link */