John Fastabend 597222f72a bpf: avoid misuse of psock when TCP_ULP_BPF collides with another ULP
Currently we check sk_user_data is non NULL to determine if the sk
exists in a map. However, this is not sufficient to ensure the psock
or the ULP ops are not in use by another user, such as kcm or TLS. To
avoid this when adding a sock to a map also verify it is of the
correct ULP type. Additionally, when releasing a psock verify that
it is the TCP_ULP_BPF type before releasing the ULP. The error case
where we abort an update due to ULP collision can cause this error
path.

For example,

  __sock_map_ctx_update_elem()
     [...]
     err = tcp_set_ulp_id(sock, TCP_ULP_BPF) <- collides with TLS
     if (err)                                <- so err out here
        goto out_free
     [...]
  out_free:
     smap_release_sock() <- calling tcp_cleanup_ulp releases the
                            TLS ULP incorrectly.

Fixes: 2f857d04601a ("bpf: sockmap, remove STRPARSER map_flags and add multi-map support")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-09-02 22:31:10 +02:00
..
2018-06-12 16:19:22 -07:00
2018-08-20 18:32:00 -07:00
2018-08-23 15:44:58 -07:00
\n
2018-08-17 09:41:28 -07:00
2018-08-15 10:46:54 -07:00
2018-04-27 14:34:51 +02:00
2018-01-05 18:43:00 +11:00
2018-07-21 10:43:12 -05:00
2018-06-08 17:21:52 -07:00
2018-06-06 16:34:00 -07:00
2018-07-03 09:20:44 +02:00
2018-06-07 16:56:28 -04:00