]> www.infradead.org Git - users/dwmw2/linux.git/commit
sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()
authorCong Wang <cong.wang@bytedance.com>
Sat, 26 Oct 2024 18:55:22 +0000 (11:55 -0700)
committerMartin KaFai Lau <martin.lau@kernel.org>
Tue, 29 Oct 2024 01:44:14 +0000 (18:44 -0700)
commit740be3b9a6d73336f8c7d540842d0831dc7a808b
treef5d0b5fda3e2c0938f1e59d42010f265f4a39323
parentae90f6a6170d7a7a1aa4fddf664fbd093e3023bc
sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()

The following race condition could trigger a NULL pointer dereference:

sock_map_link_detach(): sock_map_link_update_prog():
   mutex_lock(&sockmap_mutex);
   ...
   sockmap_link->map = NULL;
   mutex_unlock(&sockmap_mutex);
       mutex_lock(&sockmap_mutex);
   ...
   sock_map_prog_link_lookup(sockmap_link->map);
   mutex_unlock(&sockmap_mutex);
   <continue>

Fix it by adding a NULL pointer check. In this specific case, it makes
no sense to update a link which is being released.

Reported-by: Ruan Bonan <bonan.ruan@u.nus.edu>
Fixes: 699c23f02c65 ("bpf: Add bpf_link support for sk_msg and sk_skb progs")
Cc: Yonghong Song <yonghong.song@linux.dev>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/20241026185522.338562-1-xiyou.wangcong@gmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
net/core/sock_map.c