shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

bpf: fix filed access without lock

Browse Source 
[ Upstream commit a32aee8f0d987a7cba7fcc28002553361a392048 ]

The tcp_bpf_recvmsg_parser() function, running in user context,
retrieves seq_copied from tcp_sk without holding the socket lock, and
stores it in a local variable seq. However, the softirq context can
modify tcp_sk->seq_copied concurrently, for example, n tcp_read_sock().

As a result, the seq value is stale when it is assigned back to
tcp_sk->copied_seq at the end of tcp_bpf_recvmsg_parser(), leading to
incorrect behavior.

Due to concurrency, the copied_seq field in tcp_bpf_recvmsg_parser()
might be set to an incorrect value (less than the actual copied_seq) at
the end of function: 'WRITE_ONCE(tcp->copied_seq, seq)'. This causes the
'offset' to be negative in tcp_read_sock()->tcp_recv_skb() when
processing new incoming packets (sk->copied_seq - skb->seq becomes less
than 0), and all subsequent packets will be dropped.

Signed-off-by: Jiayuan Chen <mrpre@163.com>
Link: https://lore.kernel.org/r/20241028065226.35568-1-mrpre@163.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jiayuan Chen
2024-10-28 14:52:26 +08:00
committed by Greg Kroah-Hartman
parent 665edd4bc0
commit 79b09458eb
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
net/ipv4/tcp_bpf.c
View File

@@ -216,11 +216,11 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,
int flags, int flags,
int *addr_len) int *addr_len)
{ {
struct tcp_sock *tcp = tcp_sk(sk);
int peek = flags & MSG_PEEK; int peek = flags & MSG_PEEK;
u32 seq = tcp->copied_seq;
struct sk_psock *psock; struct sk_psock *psock;
struct tcp_sock *tcp;
int copied = 0; int copied = 0;
u32 seq;
if (unlikely(flags & MSG_ERRQUEUE)) if (unlikely(flags & MSG_ERRQUEUE))
return inet_recv_error(sk, msg, len, addr_len); return inet_recv_error(sk, msg, len, addr_len);
@@ -233,7 +233,8 @@ static int tcp_bpf_recvmsg_parser(struct sock *sk,
return tcp_recvmsg(sk, msg, len, flags, addr_len); return tcp_recvmsg(sk, msg, len, flags, addr_len);
lock_sock(sk); lock_sock(sk);
tcp = tcp_sk(sk);
seq = tcp->copied_seq;
/* We may have received data on the sk_receive_queue pre-accept and /* We may have received data on the sk_receive_queue pre-accept and
* then we can not use read_skb in this context because we haven't * then we can not use read_skb in this context because we haven't
* assigned a sk_socket yet so have no link to the ops. The work-around * assigned a sk_socket yet so have no link to the ops. The work-around