| Message ID | 20250213-vsock-listen-sockmap-nullptr-v1-0-994b7cd2f16b@rbox.co (mailing list archive) |
|---|---|
| Headers | show |
| Series | sockmap, vsock: For connectible sockets allow only connected | expand |
Hello: This series was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Thu, 13 Feb 2025 12:58:48 +0100 you wrote: > Series deals with one more case of vsock surprising BPF/sockmap by being > inconsistency about (having an) assigned transport. > > KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] > CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ > Workqueue: vsock-loopback vsock_loopback_work > RIP: 0010:vsock_read_skb+0x4b/0x90 > Call Trace: > sk_psock_verdict_data_ready+0xa4/0x2e0 > virtio_transport_recv_pkt+0x1ca8/0x2acc > vsock_loopback_work+0x27d/0x3f0 > process_one_work+0x846/0x1420 > worker_thread+0x5b3/0xf80 > kthread+0x35a/0x700 > ret_from_fork+0x2d/0x70 > ret_from_fork_asm+0x1a/0x30 > > [...] Here is the summary with links: - [net,1/4] sockmap, vsock: For connectible sockets allow only connected https://git.kernel.org/netdev/net/c/8fb5bb169d17 - [net,2/4] vsock/bpf: Warn on socket without transport https://git.kernel.org/netdev/net/c/857ae05549ee - [net,3/4] selftest/bpf: Adapt vsock_delete_on_close to sockmap rejecting unconnected https://git.kernel.org/netdev/net/c/8350695bfb16 - [net,4/4] selftest/bpf: Add vsock test for sockmap rejecting unconnected https://git.kernel.org/netdev/net/c/85928e9c4363 You are awesome, thank you!
Series deals with one more case of vsock surprising BPF/sockmap by being inconsistency about (having an) assigned transport. KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127] CPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+ Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_read_skb+0x4b/0x90 Call Trace: sk_psock_verdict_data_ready+0xa4/0x2e0 virtio_transport_recv_pkt+0x1ca8/0x2acc vsock_loopback_work+0x27d/0x3f0 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x35a/0x700 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 This bug, similarly to commit f6abafcd32f9 ("vsock/bpf: return early if transport is not assigned"), could be fixed with a single NULL check. But instead, let's explore another approach: take a hint from vsock_bpf_update_proto() and teach sockmap to accept only vsocks that are already connected (no risk of transport being dropped or reassigned). At the same time straight reject the listeners (vsock listening sockets do not carry any transport anyway). This way BPF does not have to worry about vsk->transport becoming NULL. Signed-off-by: Michal Luczaj <mhal@rbox.co> --- Michal Luczaj (4): sockmap, vsock: For connectible sockets allow only connected vsock/bpf: Warn on socket without transport selftest/bpf: Adapt vsock_delete_on_close to sockmap rejecting unconnected selftest/bpf: Add vsock test for sockmap rejecting unconnected net/core/sock_map.c | 3 + net/vmw_vsock/af_vsock.c | 3 + net/vmw_vsock/vsock_bpf.c | 2 +- .../selftests/bpf/prog_tests/sockmap_basic.c | 70 ++++++++++++++++------ 4 files changed, 59 insertions(+), 19 deletions(-) --- base-commit: 9c01a177c2e4b55d2bcce8a1f6bdd1d46a8320e3 change-id: 20250210-vsock-listen-sockmap-nullptr-e6e82ca79611 Best regards,