Commit 94d6a0c0 authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by Liu Jian
Browse files

Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem" 

mainline inclusion
from mainline-v6.10-rc2
commit 3b9ce0491a43e9af7f108b2f1bced7cd35931660
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG7M
CVE: CVE-2024-35895

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b9ce0491a43e9af7f108b2f1bced7cd35931660



---------------------------

This reverts commit ff91059932401894e6c86341915615c5eb0eca48.

This check is no longer needed. BPF programs attached to tracepoints are
now rejected by the verifier when they attempt to delete from a
sockmap/sockhash maps.

Signed-off-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20240527-sockmap-verify-deletes-v1-2-944b372f2101@cloudflare.com



Conflicts:
	net/core/sock_map.c
[This is because we did not backport 35d2b7ff.]
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 9c142989

net/core/sock_map.c

+0 −6
Original line number Diff line number Diff line
@@ -434,9 +434,6 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, 
	struct sock *sk;

	int err = 0;



	if (irqs_disabled())

		return -EOPNOTSUPP; /* locks here are hardirq-unsafe */



	raw_spin_lock_bh(&stab->lock);

	sk = *psk;

	if (!sk_test || sk_test == sk)
@@ -970,9 +967,6 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) 
	struct bpf_shtab_elem *elem;

	int ret = -ENOENT;



	if (irqs_disabled())

		return -EOPNOTSUPP; /* locks here are hardirq-unsafe */



	hash = sock_hash_bucket_hash(key, key_size);

	bucket = sock_hash_select_bucket(htab, hash);