Cong Wang aadb2bb83f sock_map: Fix a potential use-after-free in sock_map_close() ... The last refcnt of the psock can be gone right after sock_map_remove_links(), so sk_psock_stop() could trigger a UAF. The reason why I placed sk_psock_stop() there is to avoid RCU read critical section, and more importantly, some callee of sock_map_remove_links() is supposed to be called with RCU read lock, we can not simply get rid of RCU read lock here. Therefore, the only choice we have is to grab an additional refcnt with sk_psock_get() and put it back after sk_psock_stop(). Fixes: 799aa7f98d ("skmsg: Avoid lock_sock() in sk_psock_backlog()") Reported-by: syzbot+7b6548ae483d6f4c64ae@syzkaller.appspotmail.com Signed-off-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: John Fastabend <john.fastabend@gmail.com> Acked-by: Jakub Sitnicki <jakub@cloudflare.com> Link: https://lore.kernel.org/bpf/20210408030556.45134-1-xiyou.wangcong@gmail.com		2021-04-12 17:35:26 +02:00
..
bpf_sk_storage.c	bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]	2021-02-26 11:51:48 -08:00
datagram.c	udp: fix skb_copy_and_csum_datagram with odd segment sizes	2021-02-04 18:56:56 -08:00
datagram.h
dev_addr_lists.c	net: core: Correct function name dev_uc_flush() in the kerneldoc	2021-03-28 17:56:56 -07:00
dev_ioctl.c	net: fix dev_ifsioc_locked() race condition	2021-02-11 18:14:19 -08:00
dev.c	net: change netdev_unregister_timeout_secs min value to 1	2021-03-25 17:24:06 -07:00
devlink.c	mlx5 subfunction support	2021-01-28 16:57:19 -08:00
drop_monitor.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-03-25 15:31:22 -07:00
dst_cache.c
dst.c	net, bpf: Fix ip6ip6 crash with collect_md populated skbs	2021-03-10 12:24:18 -08:00
failover.c
fib_notifier.c
fib_rules.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
filter.c	bpf: selftests: Add kfunc_call test	2021-03-26 20:41:52 -07:00
flow_dissector.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-03-25 15:31:22 -07:00
flow_offload.c	net: flow_offload: Fix memory leak for indirect flow block	2020-12-09 16:08:33 -08:00
gen_estimator.c	net_sched: gen_estimator: support large ewma log	2021-01-15 18:11:06 -08:00
gen_stats.c	docs: networking: convert gen_stats.txt to ReST	2020-04-28 14:39:46 -07:00
gro_cells.c	gro_cells: reduce number of synchronize_net() calls	2020-11-25 11:28:12 -08:00
hwbm.c
link_watch.c	net: Add IF_OPER_TESTING	2020-04-20 12:43:24 -07:00
lwt_bpf.c	lwt_bpf: Replace preempt_disable() with migrate_disable()	2020-12-07 11:53:40 -08:00
lwtunnel.c	net: ipv6: add rpl sr tunnel	2020-03-29 22:30:57 -07:00
Makefile	bpf: Clean up sockmap related Kconfigs	2021-02-26 12:28:03 -08:00
neighbour.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2021-02-02 14:21:31 -08:00
net_namespace.c	net: initialize net->net_cookie at netns setup	2021-02-11 14:10:07 -08:00
net-procfs.c	net: move the ptype_all and ptype_base declarations to include/linux/netdevice.h	2021-03-22 13:14:45 -07:00
net-sysfs.c	net-sysfs: remove possible sleep from an RCU read-side critical section	2021-03-22 13:28:13 -07:00
net-sysfs.h	net-sysfs: add netdev_change_owner()	2020-02-26 20:07:25 -08:00
net-traces.c
netclassid_cgroup.c	net: Remove the err argument from sock_from_file	2020-12-04 22:32:40 +01:00
netevent.c	net: core: Correct function name netevent_unregister_notifier() in the kerneldoc	2021-03-28 17:56:56 -07:00
netpoll.c	Revert "net: Have netpoll bring-up DSA management interface"	2021-02-06 14:42:57 -08:00
netprio_cgroup.c	net: Remove the err argument from sock_from_file	2020-12-04 22:32:40 +01:00
page_pool.c	net: page_pool: simplify page recycling condition tests	2021-02-04 18:20:14 -08:00
pktgen.c	pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()	2021-01-27 16:46:37 -08:00
ptp_classifier.c	ptp: Add generic ptp v2 header parsing function	2020-08-19 16:07:49 -07:00
request_sock.c
rtnetlink.c	rtnetlink: using dev_base_seq from target net	2021-03-03 16:59:17 -08:00
scm.c	fs: Add receive_fd() wrapper for __receive_fd()	2020-07-13 11:03:44 -07:00
secure_seq.c	crypto: lib/sha1 - remove unnecessary includes of linux/cryptohash.h	2020-05-08 15:32:17 +10:00
skbuff.c	net: Introduce skb_send_sock() for sock_map	2021-04-01 10:56:13 -07:00
skmsg.c	skmsg: Extract __tcp_bpf_recvmsg() and tcp_bpf_wait_data()	2021-04-01 10:56:14 -07:00
sock_diag.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
sock_map.c	sock_map: Fix a potential use-after-free in sock_map_close()	2021-04-12 17:35:26 +02:00
sock_reuseport.c	udp: Prevent reuseport_select_sock from reading uninitialized socks	2021-01-08 19:15:40 -08:00
sock.c	net: sock: simplify tw proto registration	2021-03-11 16:05:08 -08:00
stream.c
sysctl_net_core.c	net: change netdev_unregister_timeout_secs min value to 1	2021-03-25 17:24:06 -07:00
timestamping.c
tso.c	net: tso: add UDP segmentation support	2020-06-18 20:46:23 -07:00
utils.c	net: Fix skb->csum update in inet_proto_csum_replace16().	2020-01-24 20:54:30 +01:00
xdp.c	net, veth: Alloc skb in bulk for ndo_xdp_xmit	2021-02-04 01:00:07 +01:00