Commit 8163999d authored Nov 21, 2019 by John Fastabend Committed by David S. Miller Nov 21, 2019

bpf: skmsg, fix potential psock NULL pointer dereference



Report from Dan Carpenter,

 net/core/skmsg.c:792 sk_psock_write_space()
 error: we previously assumed 'psock' could be null (see line 790)

 net/core/skmsg.c
   789 psock = sk_psock(sk);
   790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
 Check for NULL
   791 schedule_work(&psock->work);
   792 write_space = psock->saved_write_space;
                     ^^^^^^^^^^^^^^^^^^^^^^^^
   793          rcu_read_unlock();
   794          write_space(sk);

Ensure psock dereference on line 792 only occurs if psock is not null.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 604326b4 ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 7599a896

net/core/skmsg.c

+8 −5

Original line number	Diff line number	Diff line
		@@ -793,14 +793,17 @@ static void sk_psock_strp_data_ready(struct sock *sk)
		static void sk_psock_write_space(struct sock *sk)
		{
		struct sk_psock *psock;
		void (write_space)(struct sock sk);
		void (write_space)(struct sock sk) = NULL;

		rcu_read_lock();
		psock = sk_psock(sk);
		if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
		if (likely(psock)) {
		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
		schedule_work(&psock->work);
		write_space = psock->saved_write_space;
		}
		rcu_read_unlock();
		if (write_space)
		write_space(sk);
		}

Admin message