diff mbox series

net: sockmap: Don't call bpf_prog_put() on NULL pointer

Message ID 20201012170952.60750-1-alex.dewar90@gmail.com (mailing list archive)
State Accepted
Commit 83c11c17553c0fca217105c17444c4ef5ab2403f
Delegated to: BPF
Headers show
Series net: sockmap: Don't call bpf_prog_put() on NULL pointer | expand

Commit Message

Alex Dewar Oct. 12, 2020, 5:09 p.m. UTC 
If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
called unconditionally on skb_verdict, even though it may be NULL. Fix
and tidy up error path.

Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
---
 net/core/sock_map.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

Comments

Jakub Sitnicki Oct. 14, 2020, 9:20 a.m. UTC | #1 
On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote:
> If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
> called unconditionally on skb_verdict, even though it may be NULL. Fix
> and tidy up error path.
>
> Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
> Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> ---

Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Jakub Sitnicki Oct. 14, 2020, 9:32 a.m. UTC | #2 
On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote:
> If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
> called unconditionally on skb_verdict, even though it may be NULL. Fix
> and tidy up error path.
>
> Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
> Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> ---

Note to maintainers: the issue exists only in bpf-next where we have:

  https://lore.kernel.org/bpf/160239294756.8495.5796595770890272219.stgit@john-Precision-5820-Tower/

The patch also looks like it is supposed to be applied on top of the above.
Alex Dewar Oct. 14, 2020, 9:45 a.m. UTC | #3 
On 14/10/2020 10:32, Jakub Sitnicki wrote:
> On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote:
>> If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
>> called unconditionally on skb_verdict, even though it may be NULL. Fix
>> and tidy up error path.
>>
>> Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
>> Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
>> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
>> ---
> Note to maintainers: the issue exists only in bpf-next where we have:
>
>    https://lore.kernel.org/bpf/160239294756.8495.5796595770890272219.stgit@john-Precision-5820-Tower/
>
> The patch also looks like it is supposed to be applied on top of the above.
Yes, the patch is based on linux-next.
John Fastabend Oct. 15, 2020, 4:43 a.m. UTC | #4 
Jakub Sitnicki wrote:
> On Mon, Oct 12, 2020 at 07:09 PM CEST, Alex Dewar wrote:
> > If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
> > called unconditionally on skb_verdict, even though it may be NULL. Fix
> > and tidy up error path.
> >
> > Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
> > Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
> > Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> > ---
> 
> Acked-by: Jakub Sitnicki <jakub@cloudflare.com>

Thanks.

Jakub, any opinions on if we should just throw an error if users try to
add a sock to a map with a parser but no verdict? At the moment we fall
through and add the socket, but it wont do any receive parsing/verdict.
At the moment I think its fine with above fix. The useful cases for RX
are parser+verdict, verdict, and empty. Where empty is just used for
redirects or other socket account tricks. Just something to keep in mind.

Acked-by: John Fastabend <john.fastabend@gmail.com>
Jakub Sitnicki Oct. 15, 2020, 11:04 a.m. UTC | #5 
On Thu, Oct 15, 2020 at 06:43 AM CEST, John Fastabend wrote:

[...]

> Jakub, any opinions on if we should just throw an error if users try to
> add a sock to a map with a parser but no verdict? At the moment we fall
> through and add the socket, but it wont do any receive parsing/verdict.
> At the moment I think its fine with above fix. The useful cases for RX
> are parser+verdict, verdict, and empty. Where empty is just used for
> redirects or other socket account tricks. Just something to keep in mind.

IMO we should not fail because map updates can interleave with sk_skb
prog attachments, like so:

	update_map(map_fd, sock_fd);
	attach_prog(parser_fd, map_fd, BPF_SK_SKB_STREAM_PARSER);
	update_map(map_fd, sock_fd); // OK
	attach_prog(verdict_fd, map_fd, BPF_SK_SKB_STREAM_VERDICT);
	update_map(map_fd, sock_fd);

In practice, I would expect one process/thread to attach the programs,
while another is allowed to update the map at the same time.
patchwork-bot+netdevbpf@kernel.org Oct. 15, 2020, 7:10 p.m. UTC | #6 
Hello:

This patch was applied to bpf/bpf-next.git (refs/heads/master):

On Mon, 12 Oct 2020 18:09:53 +0100 you wrote:
> If bpf_prog_inc_not_zero() fails for skb_parser, then bpf_prog_put() is
> called unconditionally on skb_verdict, even though it may be NULL. Fix
> and tidy up error path.
> 
> Addresses-Coverity-ID: 1497799: Null pointer dereferences (FORWARD_NULL)
> Fixes: 743df8b7749f ("bpf, sockmap: Check skb_verdict and skb_parser programs explicitly")
> Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
> 
> [...]

Here is the summary with links:
  - net: sockmap: Don't call bpf_prog_put() on NULL pointer
    https://git.kernel.org/bpf/bpf-next/c/83c11c17553c

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index df09c39a4dd2..a73ccce54423 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -238,17 +238,18 @@  static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
 	int ret;
 
 	skb_verdict = READ_ONCE(progs->skb_verdict);
-	skb_parser = READ_ONCE(progs->skb_parser);
 	if (skb_verdict) {
 		skb_verdict = bpf_prog_inc_not_zero(skb_verdict);
 		if (IS_ERR(skb_verdict))
 			return PTR_ERR(skb_verdict);
 	}
+
+	skb_parser = READ_ONCE(progs->skb_parser);
 	if (skb_parser) {
 		skb_parser = bpf_prog_inc_not_zero(skb_parser);
 		if (IS_ERR(skb_parser)) {
-			bpf_prog_put(skb_verdict);
-			return PTR_ERR(skb_parser);
+			ret = PTR_ERR(skb_parser);
+			goto out_put_skb_verdict;
 		}
 	}
 
@@ -257,7 +258,7 @@  static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
 		msg_parser = bpf_prog_inc_not_zero(msg_parser);
 		if (IS_ERR(msg_parser)) {
 			ret = PTR_ERR(msg_parser);
-			goto out;
+			goto out_put_skb_parser;
 		}
 	}
 
@@ -311,11 +312,12 @@  static int sock_map_link(struct bpf_map *map, struct sk_psock_progs *progs,
 out_progs:
 	if (msg_parser)
 		bpf_prog_put(msg_parser);
-out:
-	if (skb_verdict)
-		bpf_prog_put(skb_verdict);
+out_put_skb_parser:
 	if (skb_parser)
 		bpf_prog_put(skb_parser);
+out_put_skb_verdict:
+	if (skb_verdict)
+		bpf_prog_put(skb_verdict);
 	return ret;
 }