John Fastabend 484a2f50cc bpf, sockmap: af_unix stream sockets need to hold ref for pair sock ... [ Upstream commit 8866730aed ] AF_UNIX stream sockets are a paired socket. So sending on one of the pairs will lookup the paired socket as part of the send operation. It is possible however to put just one of the pairs in a BPF map. This currently increments the refcnt on the sock in the sockmap to ensure it is not free'd by the stack before sockmap cleans up its state and stops any skbs being sent/recv'd to that socket. But we missed a case. If the peer socket is closed it will be free'd by the stack. However, the paired socket can still be referenced from BPF sockmap side because we hold a reference there. Then if we are sending traffic through BPF sockmap to that socket it will try to dereference the free'd pair in its send logic creating a use after free. And following splat: [59.900375] BUG: KASAN: slab-use-after-free in sk_wake_async+0x31/0x1b0 [59.901211] Read of size 8 at addr ffff88811acbf060 by task kworker/1:2/954 [...] [59.905468] Call Trace: [59.905787] <TASK> [59.906066] dump_stack_lvl+0x130/0x1d0 [59.908877] print_report+0x16f/0x740 [59.910629] kasan_report+0x118/0x160 [59.912576] sk_wake_async+0x31/0x1b0 [59.913554] sock_def_readable+0x156/0x2a0 [59.914060] unix_stream_sendmsg+0x3f9/0x12a0 [59.916398] sock_sendmsg+0x20e/0x250 [59.916854] skb_send_sock+0x236/0xac0 [59.920527] sk_psock_backlog+0x287/0xaa0 To fix let BPF sockmap hold a refcnt on both the socket in the sockmap and its paired socket. It wasn't obvious how to contain the fix to bpf_unix logic. The primarily problem with keeping this logic in bpf_unix was: In the sock close() we could handle the deref by having a close handler. But, when we are destroying the psock through a map delete operation we wouldn't have gotten any signal thorugh the proto struct other than it being replaced. If we do the deref from the proto replace its too early because we need to deref the sk_pair after the backlog worker has been stopped. Given all this it seems best to just cache it at the end of the psock and eat 8B for the af_unix and vsock users. Notice dgram sockets are OK because they handle locking already. Fixes: 94531cfcbe ("af_unix: Add unix_stream_proto for sockmap") Signed-off-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20231129012557.95371-2-john.fastabend@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-12-08 08:52:23 +01:00
..
acpi	ACPI: PM: Add acpi_device_fix_up_power_children() function	2023-12-03 07:33:07 +01:00
asm-generic	hyperv-fixes for v6.6-rc6	2023-10-10 11:01:21 -07:00
clocksource
crypto
drm	drm: bridge: samsung-dsim: Fix waiting for empty cmd transfer FIFO on older Exynos	2023-11-20 11:59:08 +01:00
dt-bindings
keys
kunit
kvm	KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2	2023-10-12 16:55:21 +01:00
linux	bpf, sockmap: af_unix stream sockets need to hold ref for pair sock	2023-12-08 08:52:23 +01:00
math-emu
media	media: ipu-bridge: increase sensor_name size	2023-11-28 17:19:46 +00:00
memory
misc
net	bpf, sockmap: af_unix stream sockets need to hold ref for pair sock	2023-12-08 08:52:23 +01:00
pcmcia
ras
rdma
rv
scsi	scsi: sd: Fix system start for ATA devices	2023-12-08 08:52:17 +01:00
soc	firmware: tegra: Add suspend hook and reset BPMP IPC early on resume	2023-11-20 11:59:16 +01:00
sound	ASoC: soc-dai: add flag to mute and unmute stream during trigger	2023-11-28 17:20:04 +00:00
target
trace	rxrpc: Fix RTT determination to use any ACK as a source	2023-12-03 07:33:02 +01:00
uapi	uapi: propagate __struct_group() attributes to the container union	2023-12-08 08:52:22 +01:00
ufs
vdso
video	fbdev: stifb: Make the STI next font pointer a 32-bit signed offset	2023-11-28 17:19:58 +00:00
xen	arm/xen: remove lazy mode related definitions	2023-09-19 07:04:49 +02:00