Commit e8025155 authored by Jakub Sitnicki's avatar Jakub Sitnicki Committed by Daniel Borkmann
Browse files

tcp_bpf: Don't let child socket inherit parent protocol ops on copy 



Prepare for cloning listening sockets that have their protocol callbacks
overridden by sk_msg. Child sockets must not inherit parent callbacks that
access state stored in sk_user_data owned by the parent.

Restore the child socket protocol callbacks before it gets hashed and any
of the callbacks can get invoked.

Signed-off-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20200218171023.844439-4-jakub@cloudflare.com
parent f1ff5ce2

include/net/tcp.h

+7 −0
Original line number Diff line number Diff line
@@ -2203,6 +2203,13 @@ int tcp_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 
		    int nonblock, int flags, int *addr_len);

int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,

		      struct msghdr *msg, int len, int flags);

#ifdef CONFIG_NET_SOCK_MSG

void tcp_bpf_clone(const struct sock *sk, struct sock *newsk);

#else

static inline void tcp_bpf_clone(const struct sock *sk, struct sock *newsk)

{

}

#endif



/* Call BPF_SOCK_OPS program that returns an int. If the return value

 * is < 0, then the BPF op failed (for example if the loaded BPF

net/ipv4/tcp_bpf.c

+14 −0
Original line number Diff line number Diff line
@@ -693,3 +693,17 @@ int tcp_bpf_init(struct sock *sk) 
	rcu_read_unlock();

	return 0;

}



/* If a child got cloned from a listening socket that had tcp_bpf

 * protocol callbacks installed, we need to restore the callbacks to

 * the default ones because the child does not inherit the psock state

 * that tcp_bpf callbacks expect.

 */

void tcp_bpf_clone(const struct sock *sk, struct sock *newsk)

{

	int family = sk->sk_family == AF_INET6 ? TCP_BPF_IPV6 : TCP_BPF_IPV4;

	struct proto *prot = newsk->sk_prot;



	if (prot == &tcp_bpf_prots[family][TCP_BPF_BASE])

		newsk->sk_prot = sk->sk_prot_creator;

}

net/ipv4/tcp_minisocks.c

+2 −0
Original line number Diff line number Diff line
@@ -548,6 +548,8 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, 
	newtp->fastopen_req = NULL;

	RCU_INIT_POINTER(newtp->fastopen_rsk, NULL);



	tcp_bpf_clone(sk, newsk);



	__TCP_INC_STATS(sock_net(sk), TCP_MIB_PASSIVEOPENS);



	return newsk;

CRA Git | Maintained and supported by SUSTech CRA and CCSE