Liu Jian 65029aaedd net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory ... [ Upstream commit 3f8ef65af9 ] Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue. Suggested-by: Jakub Sitnicki <jakub@cloudflare.com> Signed-off-by: Liu Jian <liujian56@huawei.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Cc: Eric Dumazet <edumazet@google.com> Link: https://lore.kernel.org/bpf/20220823133755.314697-2-liujian56@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-10-26 13:25:47 +02:00
..
bpf_sk_storage.c	net: Fix data-races around sysctl_optmem_max.	2022-08-31 17:15:20 +02:00
datagram.c	udp: fix skb_copy_and_csum_datagram with odd segment sizes	2021-02-17 11:02:28 +01:00
datagram.h
dev_addr_lists.c
dev_ioctl.c	net: socket: remove register_gifconf	2022-09-28 11:10:35 +02:00
dev.c	bpf: Don't redirect packets with invalid pkt_len	2022-09-05 10:28:56 +02:00
devlink.c	devlink: Fix use-after-free after a failed reload	2022-08-25 11:37:57 +02:00
drop_monitor.c	drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit	2022-02-23 12:01:02 +01:00
dst_cache.c	wireguard: device: reset peer src endpoint when netns exits	2021-12-08 09:03:22 +01:00
dst.c	net, bpf: Fix ip6ip6 crash with collect_md populated skbs	2021-03-30 14:32:05 +02:00
failover.c
fib_notifier.c
fib_rules.c	ipv6: fix memory leak in fib6_rule_suppress	2021-12-08 09:03:21 +01:00
filter.c	net: Fix data-races around sysctl_optmem_max.	2022-08-31 17:15:20 +02:00
flow_dissector.c	net: core: fix flow symmetric hash	2022-09-28 11:10:30 +02:00
flow_offload.c	netfilter: nf_tables: bail out early if hardware offload is not supported	2022-06-14 18:32:40 +02:00
gen_estimator.c	net_sched: gen_estimator: support large ewma log	2021-01-27 11:55:23 +01:00
gen_stats.c
gro_cells.c	net: Fix data-races around netdev_max_backlog.	2022-08-31 17:15:19 +02:00
hwbm.c
link_watch.c	net: linkwatch: fix failure to restore device state across suspend/resume	2021-08-18 08:59:13 +02:00
lwt_bpf.c	bpf, lwt: Fix crash when using bpf_skb_set_tunnel_key() from bpf_xmit lwt hook	2022-05-09 09:05:02 +02:00
lwtunnel.c	lwtunnel: Validate RTA_ENCAP_TYPE attribute length	2022-01-11 15:25:00 +01:00
Makefile
neighbour.c	net: neigh: don't call kfree_skb() under spin_lock_irqsave()	2022-09-05 10:28:59 +02:00
net_namespace.c	netns: add schedule point in ops_exit_list()	2022-01-27 10:54:33 +01:00
net-procfs.c	net-procfs: show net devices bound packet types	2022-02-01 17:25:44 +01:00
net-sysfs.c	net-sysfs: add check for netdevice being present to speed_show	2022-03-16 14:16:00 +01:00
net-sysfs.h
net-traces.c
netclassid_cgroup.c
netevent.c
netpoll.c
netprio_cgroup.c
page_pool.c	mm: fix struct page layout on 32-bit systems	2021-05-19 10:13:17 +02:00
pktgen.c	pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()	2021-03-07 12:34:09 +01:00
ptp_classifier.c
request_sock.c
rtnetlink.c	net: make free_netdev() more lenient with unregistering devices	2022-07-29 17:19:07 +02:00
scm.c
secure_seq.c	tcp: Fix data-races around sysctl knobs related to SYN option.	2022-07-29 17:19:21 +02:00
skbuff.c	net/core/skbuff: Check the return value of skb_copy_bits()	2022-09-15 11:32:03 +02:00
skmsg.c	net: fix refcount bug in sk_psock_get (2)	2022-09-05 10:28:56 +02:00
sock_diag.c
sock_map.c	bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator	2022-08-25 11:37:55 +02:00
sock_reuseport.c	udp: Prevent reuseport_select_sock from reading uninitialized socks	2021-01-23 16:03:59 +01:00
sock.c	net: Fix a data-race around sysctl_net_busy_read.	2022-08-31 17:15:20 +02:00
stream.c	net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory	2022-10-26 13:25:47 +02:00
sysctl_net_core.c	net: Fix data-races around weight_p and dev_weight_[rt]x_bias.	2022-08-31 17:15:19 +02:00
timestamping.c
tso.c
utils.c
xdp.c	xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model	2021-04-14 08:42:09 +02:00