John Fastabend bcc5b2d8a3 bpf: syzkaller found null ptr deref in unix_bpf proto add ... [ Upstream commit 8d6650646c ] I added logic to track the sock pair for stream_unix sockets so that we ensure lifetime of the sock matches the time a sockmap could reference the sock (see fixes tag). I forgot though that we allow af_unix unconnected sockets into a sock{map|hash} map. This is problematic because previous fixed expected sk_pair() to exist and did not NULL check it. Because unconnected sockets have a NULL sk_pair this resulted in the NULL ptr dereference found by syzkaller. BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 Write of size 4 at addr 0000000000000080 by task syz-executor360/5073 Call Trace: <TASK> ... sock_hold include/net/sock.h:777 [inline] unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 sock_map_init_proto net/core/sock_map.c:190 [inline] sock_map_link+0xb87/0x1100 net/core/sock_map.c:294 sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483 sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577 bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167 We considered just checking for the null ptr and skipping taking a ref on the NULL peer sock. But, if the socket is then connected() after being added to the sockmap we can cause the original issue again. So instead this patch blocks adding af_unix sockets that are not in the ESTABLISHED state. Reported-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot+e8030702aefd3444fb9e@syzkaller.appspotmail.com Fixes: 8866730aed ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock") Acked-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/r/20231201180139.328529-2-john.fastabend@gmail.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-01-01 12:42:28 +00:00
..
acpi	ACPI: PM: Add acpi_device_fix_up_power_children() function	2023-12-03 07:33:07 +01:00
asm-generic	asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation	2023-12-20 17:01:59 +01:00
clocksource
crypto
drm	drm: Update file owner during use	2024-01-01 12:42:25 +00:00
dt-bindings
keys
kunit
kvm	KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2	2023-10-12 16:55:21 +01:00
linux	wifi: ieee80211: don't require protected vendor action frames	2024-01-01 12:42:26 +00:00
math-emu
media	media: ipu-bridge: increase sensor_name size	2023-11-28 17:19:46 +00:00
memory
misc
net	bpf: syzkaller found null ptr deref in unix_bpf proto add	2024-01-01 12:42:28 +00:00
pcmcia
ras
rdma	RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz	2023-12-13 18:45:16 +01:00
rv
scsi	scsi: sd: Fix system start for ATA devices	2023-12-08 08:52:17 +01:00
soc	firmware: tegra: Add suspend hook and reset BPMP IPC early on resume	2023-11-20 11:59:16 +01:00
sound	ASoC: soc-dai: add flag to mute and unmute stream during trigger	2023-11-28 17:20:04 +00:00
target
trace	rxrpc: Fix RTT determination to use any ACK as a source	2023-12-03 07:33:02 +01:00
uapi	fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP	2023-12-20 17:01:51 +01:00
ufs
vdso
video	fbdev: stifb: Make the STI next font pointer a 32-bit signed offset	2023-11-28 17:19:58 +00:00
xen	arm/xen: remove lazy mode related definitions	2023-09-19 07:04:49 +02:00