Lorenz Bauer 7842c7b30d bpf, sockmap: Check update requirements after locking ... commit 85b8ac01a4 upstream. It's currently possible to insert sockets in unexpected states into a sockmap, due to a TOCTTOU when updating the map from a syscall. sock_map_update_elem checks that sk->sk_state == TCP_ESTABLISHED, locks the socket and then calls sock_map_update_common. At this point, the socket may have transitioned into another state, and the earlier assumptions don't hold anymore. Crucially, it's conceivable (though very unlikely) that a socket has become unhashed. This breaks the sockmap's assumption that it will get a callback via sk->sk_prot->unhash. Fix this by checking the (fixed) sk_type and sk_protocol without the lock, followed by a locked check of sk_state. Unfortunately it's not possible to push the check down into sock_(map|hash)_update_common, since BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB run before the socket has transitioned from TCP_SYN_RECV into TCP_ESTABLISHED. Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Lorenz Bauer <lmb@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20200207103713.28175-1-lmb@cloudflare.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-02-14 16:34:10 -05:00
..
bpf_sk_storage.c	bpf: Improve bucket_log calculation logic	2020-02-14 16:34:10 -05:00
datagram.c	net: add READ_ONCE() annotation in __skb_wait_for_more_packets()	2019-10-28 13:33:41 -07:00
datagram.h	net/core: Allow the compiler to verify declaration and definition consistency	2019-03-27 13:49:44 -07:00
dev.c	net: Fix packet reordering caused by GRO and listified RX cooperation	2020-01-29 16:45:22 +01:00
dev_addr_lists.c	net: remove unnecessary variables and callback	2019-10-24 14:53:49 -07:00
dev_ioctl.c	net/core: Document all dev_ioctl() arguments	2019-03-27 13:49:43 -07:00
devlink.c	devlink: report 0 after hitting end in region read	2020-02-11 04:35:48 -08:00
drop_monitor.c	drop_monitor: Do not cancel uninitialized work item	2020-02-11 04:35:51 -08:00
dst.c	net: print proper warning on dst underflow	2019-09-26 09:05:56 +02:00
dst_cache.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ethtool.c	net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()	2019-10-26 11:20:10 -07:00
failover.c	failover: allow name change on IFF_UP slave interfaces	2019-04-10 22:12:26 -07:00
fib_notifier.c	net: fib_notifier: move fib_notifier_ops from struct net into per-net struct	2019-09-07 17:28:22 +02:00
fib_rules.c	SPDX update for 5.2-rc4	2019-06-08 12:52:42 -07:00
filter.c	net: bpf: Don't leak time wait and request sockets	2020-01-23 08:22:49 +01:00
flow_dissector.c	flow_dissector: Fix to use new variables for port ranges in bpf hook	2020-02-05 21:22:52 +00:00
flow_offload.c	net: core: rename indirect block ingress cb function	2019-12-18 16:08:47 +01:00
gen_estimator.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
gen_stats.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
gro_cells.c	gro_cells: make sure device is up in gro_cells_receive()	2019-03-10 11:07:14 -07:00
hwbm.c	net: hwbm: Make the hwbm_pool lock a mutex	2019-06-09 19:40:10 -07:00
link_watch.c	net: link_watch: prevent starvation when processing linkwatch wq	2019-07-01 19:02:47 -07:00
lwt_bpf.c	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2019-12-18 16:08:42 +01:00
lwtunnel.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
Makefile	bpf: Introduce bpf sk local storage	2019-04-27 09:07:04 -07:00
neighbour.c	net: neigh: use long type to store jiffies delta	2020-01-26 10:01:06 +01:00
net-procfs.c	treewide: Switch printk users from %pf and %pF to %ps and %pS, respectively	2019-04-09 14:19:06 +02:00
net-sysfs.c	net-sysfs: Call dev_hold always in netdev_queue_add_kobject	2020-01-26 10:01:09 +01:00
net-sysfs.h
net-traces.c	page_pool: add tracepoints for page_pool with details need by XDP	2019-06-19 11:23:13 -04:00
net_namespace.c	netns: fix GFP flags in rtnl_net_notifyid()	2019-10-25 20:14:42 -07:00
netclassid_cgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netevent.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netpoll.c	net: fix skb use after free in netpoll	2019-08-27 20:52:02 -07:00
netprio_cgroup.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
page_pool.c	page_pool: do not release pool until inflight == 0.	2019-12-18 16:09:07 +01:00
pktgen.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2019-09-18 12:34:53 -07:00
ptp_classifier.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
request_sock.c	tcp: add rcu protection around tp->fastopen_rsk	2019-10-13 10:13:08 -07:00
rtnetlink.c	net: rtnetlink: validate IFLA_MTU attribute in rtnl_create_link()	2020-01-29 16:45:21 +01:00
scm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
secure_seq.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
skbuff.c	net: Fixed updating of ethertype in skb_mpls_push()	2019-12-18 16:08:56 +01:00
skmsg.c	net, sk_msg: Don't check if sock is locked when tearing down psock	2020-01-29 16:45:31 +01:00
sock.c	net: annotate lockless accesses to sk->sk_pacing_shift	2020-01-09 10:20:07 +01:00
sock_diag.c	sock: make cookie generation global instead of per netns	2019-08-09 13:14:46 -07:00
sock_map.c	bpf, sockmap: Check update requirements after locking	2020-02-14 16:34:10 -05:00
sock_reuseport.c	udp: correct reuseport selection with connected sockets	2019-09-16 09:02:18 +02:00
stream.c	tcp: make sure EPOLLOUT wont be missed	2019-08-19 13:07:43 -07:00
sysctl_net_core.c	net, sysctl: Fix compiler warning when only cBPF is present	2020-01-09 10:20:03 +01:00
timestamping.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61	2019-05-24 17:36:45 +02:00
tso.c	net: Use skb accessors in network core	2019-07-22 20:47:56 -07:00
utils.c	net: Fix skb->csum update in inet_proto_csum_replace16().	2020-02-05 21:22:52 +00:00
xdp.c	xdp: obtain the mem_id mutex before trying to remove an entry.	2019-12-18 16:09:10 +01:00