Commit 15c480ef authored Aug 24, 2018 by Daniel Borkmann Committed by Alexei Starovoitov Aug 27, 2018

bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg



In bpf_tcp_recvmsg() we first took a reference on the psock, however
once we find that there are skbs in the normal socket's receive queue
we return with processing them through tcp_recvmsg(). Problem is that
we leak the taken reference on the psock in that path. Given we don't
really do anything with the psock at this point, move the skb_queue_empty()
test before we fetch the psock to fix this case.

Fixes: 8934ce2f ("bpf: sockmap redirect ingress support")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent e06fa9c1

kernel/bpf/sockmap.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -912,6 +912,8 @@ static int bpf_tcp_recvmsg(struct sock sk, struct msghdr msg, size_t len,

		if (unlikely(flags & MSG_ERRQUEUE))
		return inet_recv_error(sk, msg, len, addr_len);
		if (!skb_queue_empty(&sk->sk_receive_queue))
		return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);

		rcu_read_lock();
		psock = smap_psock_sk(sk);
		@@ -922,9 +924,6 @@ static int bpf_tcp_recvmsg(struct sock sk, struct msghdr msg, size_t len,
		goto out;
		rcu_read_unlock();

		if (!skb_queue_empty(&sk->sk_receive_queue))
		return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);

		lock_sock(sk);
		bytes_ready:
		while (copied != len) {