[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.18 052/168] bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
4.18-stable review patch.  If anyone has any objections, please let me know.


From: John Fastabend <>

[ Upstream commit 597222f72a94118f593e4f32bf58ae7e049a0df1 ]

Currently we check sk_user_data is non NULL to determine if the sk
exists in a map. However, this is not sufficient to ensure the psock
or the ULP ops are not in use by another user, such as kcm or TLS. To
avoid this when adding a sock to a map also verify it is of the
correct ULP type. Additionally, when releasing a psock verify that
it is the TCP_ULP_BPF type before releasing the ULP. The error case
where we abort an update due to ULP collision can cause this error

For example,

err = tcp_set_ulp_id(sock, TCP_ULP_BPF) <- collides with TLS
if (err) <- so err out here
goto out_free
smap_release_sock() <- calling tcp_cleanup_ulp releases the
TLS ULP incorrectly.

Fixes: 2f857d04601a ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support")
Signed-off-by: John Fastabend <>
Signed-off-by: Daniel Borkmann <>
Signed-off-by: Sasha Levin <>
Signed-off-by: Greg Kroah-Hartman <>
kernel/bpf/sockmap.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)

--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1465,10 +1465,16 @@ static void smap_destroy_psock(struct rc

+static bool psock_is_smap_sk(struct sock *sk)
+ return inet_csk(sk)->icsk_ulp_ops == &bpf_tcp_ulp_ops;
static void smap_release_sock(struct smap_psock *psock, struct sock *sock)
if (refcount_dec_and_test(&psock->refcnt)) {
- tcp_cleanup_ulp(sock);
+ if (psock_is_smap_sk(sock))
+ tcp_cleanup_ulp(sock);
smap_stop_sock(psock, sock);
@@ -1895,6 +1901,10 @@ static int __sock_map_ctx_update_elem(st
* doesn't update user data.
if (psock) {
+ if (!psock_is_smap_sk(sock)) {
+ err = -EBUSY;
+ goto out_progs;
+ }
if (READ_ONCE(psock->bpf_parse) && parse) {
err = -EBUSY;
goto out_progs;

 \ /
  Last update: 2018-10-08 21:02    [W:0.486 / U:0.928 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site