From: John Fastabend <john.fastabend@gmail.com>
To: martin.lau@kernel.org, edumazet@google.com, jakub@cloudflare.com
Cc: john.fastabend@gmail.com, bpf@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH bpf v2 0/2] bpf fix for unconnect af_unix socket
Date: Fri, 1 Dec 2023 10:01:37 -0800 [thread overview]
Message-ID: <20231201180139.328529-1-john.fastabend@gmail.com> (raw)
Eric reported a syzbot splat from a null ptr deref from recent fix to
resolve a use-after-free with af-unix stream sockets and BPF sockmap
usage.
The issue is I missed is we allow unconnected af_unix STREAM sockets to
be added to the sockmap. Fix this by blocking unconnected sockets.
v2: change sk_is_unix to sk_is_stream_unix (Eric) and remove duplicate
ASSERTS in selftests the xsocket helper already marks FAIL (Jakub)
John Fastabend (2):
bpf: syzkaller found null ptr deref in unix_bpf proto add
bpf: sockmap, test for unconnected af_unix sock
include/net/sock.h | 5 +++
net/core/sock_map.c | 2 ++
.../selftests/bpf/prog_tests/sockmap_basic.c | 34 +++++++++++++++++++
3 files changed, 41 insertions(+)
--
2.33.0
next reply other threads:[~2023-12-01 18:01 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-01 18:01 John Fastabend [this message]
2023-12-01 18:01 ` [PATCH bpf v2 1/2] bpf: syzkaller found null ptr deref in unix_bpf proto add John Fastabend
2023-12-01 21:14 ` Kuniyuki Iwashima
2023-12-04 21:40 ` John Fastabend
2023-12-04 22:37 ` Kuniyuki Iwashima
2023-12-06 9:47 ` Jakub Sitnicki
2023-12-08 4:19 ` Cong Wang
2023-12-11 14:56 ` Daniel Borkmann
2023-12-13 23:23 ` [External] " Amery Hung
2023-12-01 18:01 ` [PATCH bpf v2 2/2] bpf: sockmap, test for unconnected af_unix sock John Fastabend
2023-12-12 10:09 ` [PATCH bpf v2 0/2] bpf fix for unconnect af_unix socket Jakub Sitnicki
2023-12-14 1:40 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231201180139.328529-1-john.fastabend@gmail.com \
--to=john.fastabend@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=edumazet@google.com \
--cc=jakub@cloudflare.com \
--cc=martin.lau@kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.