Commit 5731a879 authored Jan 04, 2018 by John Fastabend Committed by Daniel Borkmann Jan 07, 2018

bpf: sockmap missing NULL psock check



Add psock NULL check to handle a racing sock event that can get the
sk_callback_lock before this case but after xchg happens causing the
refcnt to hit zero and sock user data (psock) to be null and queued
for garbage collection.

Also add a comment in the code because this is a bit subtle and
not obvious in my opinion.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent 51335502

kernel/bpf/sockmap.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -591,8 +591,15 @@ static void sock_map_free(struct bpf_map *map)

		write_lock_bh(&sock->sk_callback_lock);
		psock = smap_psock_sk(sock);
		/* This check handles a racing sock event that can get the
		* sk_callback_lock before this case but after xchg happens
		* causing the refcnt to hit zero and sock user data (psock)
		* to be null and queued for garbage collection.
		*/
		if (likely(psock)) {
		smap_list_remove(psock, &stab->sock_map[i]);
		smap_release_sock(psock, sock);
		}
		write_unlock_bh(&sock->sk_callback_lock);
		}
		rcu_read_unlock();