Alexei Starovoitov 66e58e0ef8 bpfilter: fix race in pipe access ... syzbot reported the following crash [ 338.293946] bpfilter: read fail -512 [ 338.304515] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 338.311863] general protection fault: 0000 [#1] SMP KASAN [ 338.344360] RIP: 0010:__vfs_write+0x4a6/0x960 [ 338.426363] Call Trace: [ 338.456967] __kernel_write+0x10c/0x380 [ 338.460928] __bpfilter_process_sockopt+0x1d8/0x35b [ 338.487103] bpfilter_mbox_request+0x4d/0xb0 [ 338.491492] bpfilter_ip_get_sockopt+0x6b/0x90 This can happen when multiple cpus trying to talk to user mode process via bpfilter_mbox_request(). One cpu grabs the mutex while another goes to sleep on the same mutex. Then former cpu sees that umh pipe is down and shuts down the pipes. Later cpu finally acquires the mutex and crashes on freed pipe. Fix the race by using info.pid as an indicator that umh and pipes are healthy and check it after acquiring the mutex. Fixes: d2ba09c17a ("net: add skeleton of bpfilter kernel module") Reported-by: syzbot+7ade6c94abb2774c0fee@syzkaller.appspotmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-06-07 20:07:28 -04:00
..
bpfilter_kern.c	bpfilter: fix race in pipe access	2018-06-07 20:07:28 -04:00
Kconfig	bpfilter: fix build dependency	2018-05-24 09:33:28 -04:00
main.c	bpfilter: don't pass O_CREAT when opening console for debug	2018-05-24 09:36:49 -04:00
Makefile	bpfilter: fix OUTPUT_FORMAT	2018-06-07 16:56:48 -04:00
msgfmt.h