Commit 740be3b9 authored by Cong Wang's avatar Cong Wang Committed by Martin KaFai Lau
Browse files

sock_map: fix a NULL pointer dereference in sock_map_link_update_prog() 



The following race condition could trigger a NULL pointer dereference:

sock_map_link_detach():		sock_map_link_update_prog():
   mutex_lock(&sockmap_mutex);
   ...
   sockmap_link->map = NULL;
   mutex_unlock(&sockmap_mutex);
   				   mutex_lock(&sockmap_mutex);
				   ...
				   sock_map_prog_link_lookup(sockmap_link->map);
				   mutex_unlock(&sockmap_mutex);
   <continue>

Fix it by adding a NULL pointer check. In this specific case, it makes
no sense to update a link which is being released.

Reported-by: default avatarRuan Bonan <bonan.ruan@u.nus.edu>
Fixes: 699c23f0 ("bpf: Add bpf_link support for sk_msg and sk_skb progs")
Cc: Yonghong Song <yonghong.song@linux.dev>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: default avatarCong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/20241026185522.338562-1-xiyou.wangcong@gmail.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parent ae90f6a6

net/core/sock_map.c

+4 −0
Original line number Diff line number Diff line
@@ -1760,6 +1760,10 @@ static int sock_map_link_update_prog(struct bpf_link *link, 
		ret = -EINVAL;

		goto out;

	}

	if (!sockmap_link->map) {

		ret = -ENOLINK;

		goto out;

	}



	ret = sock_map_prog_link_lookup(sockmap_link->map, &pprog, &plink,

					sockmap_link->attach_type);