| Message ID | 20201012170952.60750-1-alex.dewar90@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | net: sockmap: Don't call bpf_prog_put() on NULL pointer | expand |
On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote: > If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is > called unconditionally on skb_verdict, even though it may be NULL. Fix > and tidy up error path. > > Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) > Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > --- Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote: > If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is > called unconditionally on skb_verdict, even though it may be NULL. Fix > and tidy up error path. > > Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) > Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > --- Note to maintainers: the issue exists only in bpf-next where we have: https://lore.kernel.org/bpf/160239294756.8495.5796595770890272219.stgit@john-Precision-5820-Tower/ The patch also looks like it is supposed to be applied on top of the above.
On 14/10/2020 10:32, Jakub Sitnicki wrote: > On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote: >> If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is >> called unconditionally on skb_verdict, even though it may be NULL. Fix >> and tidy up error path. >> >> Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) >> Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") >> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> >> --- > Note to maintainers: the issue exists only in bpf-next where we have: > > https://lore.kernel.org/bpf/160239294756.8495.5796595770890272219.stgit@john-Precision-5820-Tower/ > > The patch also looks like it is supposed to be applied on top of the above. Yes, the patch is based on linux-next.
Jakub Sitnicki wrote: > On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote: > > If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is > > called unconditionally on skb_verdict, even though it may be NULL. Fix > > and tidy up error path. > > > > Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) > > Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") > > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > > --- > > Acked-by: Jakub Sitnicki <jakub@cloudflare.com> Thanks. Jakub, any opinions on if we should just throw an error if users try to add a sock to a map with a parser but no verdict? At the moment we fall through and add the socket, but it wont do any receive parsing/verdict. At the moment I think its fine with above fix. The useful cases for RX are parser+verdict, verdict, and empty. Where empty is just used for redirects or other socket account tricks. Just something to keep in mind. Acked-by: John Fastabend <john.fastabend@gmail.com>
On Thu, Oct 15, 2020 at 06:43 AM CEST, John Fastabend wrote: [...] > Jakub, any opinions on if we should just throw an error if users try to > add a sock to a map with a parser but no verdict? At the moment we fall > through and add the socket, but it wont do any receive parsing/verdict. > At the moment I think its fine with above fix. The useful cases for RX > are parser+verdict, verdict, and empty. Where empty is just used for > redirects or other socket account tricks. Just something to keep in mind. IMO we should not fail because map updates can interleave with sk_skb prog attachments, like so: update_map(map_fd, sock_fd); attach_prog(parser_fd, map_fd, BPF_SK_SKB_STREAM_PARSER); update_map(map_fd, sock_fd); // OK attach_prog(verdict_fd, map_fd, BPF_SK_SKB_STREAM_VERDICT); update_map(map_fd, sock_fd); In practice, I would expect one process/thread to attach the programs, while another is allowed to update the map at the same time.
Hello: This patch was applied to bpf/bpf-next.git (refs/heads/master): On Mon, 12 Oct 2020 18:09:53 +0100 you wrote: > If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is > called unconditionally on skb_verdict, even though it may be NULL. Fix > and tidy up error path. > > Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) > Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> > > [...] Here is the summary with links: - net: sockmap: Don't call bpf_prog_put() on NULL pointer https://git.kernel.org/bpf/bpf-next/c/83c11c17553c You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/core/sock_map.c b/net/core/sock_map.c index df09c39a4dd2..a73ccce54423 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -238,17 +238,18 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, int ret; skb_verdict = READ_ONCE(progs->skb_verdict); - skb_parser = READ_ONCE(progs->skb_parser); if (skb_verdict) { skb_verdict = bpf_prog_inc_not_zero(skb_verdict); if (IS_ERR(skb_verdict)) return PTR_ERR(skb_verdict); } + + skb_parser = READ_ONCE(progs->skb_parser); if (skb_parser) { skb_parser = bpf_prog_inc_not_zero(skb_parser); if (IS_ERR(skb_parser)) { - bpf_prog_put(skb_verdict); - return PTR_ERR(skb_parser); + ret = PTR_ERR(skb_parser); + goto out_put_skb_verdict; } } @@ -257,7 +258,7 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, msg_parser = bpf_prog_inc_not_zero(msg_parser); if (IS_ERR(msg_parser)) { ret = PTR_ERR(msg_parser); - goto out; + goto out_put_skb_parser; } } @@ -311,11 +312,12 @@ static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs, out_progs: if (msg_parser) bpf_prog_put(msg_parser); -out: - if (skb_verdict) - bpf_prog_put(skb_verdict); +out_put_skb_parser: if (skb_parser) bpf_prog_put(skb_parser); +out_put_skb_verdict: + if (skb_verdict) + bpf_prog_put(skb_verdict); return ret; }
If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is called unconditionally on skb_verdict, even though it may be NULL. Fix and tidy up error path. Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL) Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly") Signed-off-by: Alex Dewar <alex.dewar90@gmail.com> --- net/core/sock_map.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)