Re: [Patch bpf] sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()

[Yonghong Song <yonghong.song@linux.dev>]

On 10/26/24 11:55 AM, Cong Wang wrote:
> From: Cong Wang <cong.wang@bytedance.com>
>
> The following race condition could trigger a NULL pointer dereference:
>
> sock_map_link_detach():		sock_map_link_update_prog():
>     mutex_lock(&sockmap_mutex);
>     ...
>     sockmap_link->map = NULL;
>     mutex_unlock(&sockmap_mutex);
>     				   mutex_lock(&sockmap_mutex);
> 				   ...
> 				   sock_map_prog_link_lookup(sockmap_link->map);
> 				   mutex_unlock(&sockmap_mutex);
>     <continue>
>
> Fix it by adding a NULL pointer check. In this specific case, it makes
> no sense to update a link which is being released.
>
> Reported-by: Ruan Bonan <bonan.ruan@u.nus.edu>
> Fixes: 699c23f02c65 ("bpf: Add bpf_link support for sk_msg and sk_skb progs")
> Cc: Yonghong Song <yonghong.song@linux.dev>
> Cc: John Fastabend <john.fastabend@gmail.com>
> Cc: Jakub Sitnicki <jakub@cloudflare.com>
> Signed-off-by: Cong Wang <cong.wang@bytedance.com>
> ---
>   net/core/sock_map.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/net/core/sock_map.c b/net/core/sock_map.c
> index 07d6aa4e39ef..9fca4db52f57 100644
> --- a/net/core/sock_map.c
> +++ b/net/core/sock_map.c
> @@ -1760,6 +1760,10 @@ static int sock_map_link_update_prog(struct bpf_link *link,
>   		ret = -EINVAL;
>   		goto out;
>   	}
> +	if (!sockmap_link->map) {
> +		ret = -EINVAL;

Thanks for the fix. Maybe we should use -ENOENT as the return error code?
In this case, update_prog failed due to sockmap_link->map == NULL which is
equivalent to no 'entry' to update.

> +		goto out;
> +	}
>   
>   	ret = sock_map_prog_link_lookup(sockmap_link->map, &pprog, &plink,
>   					sockmap_link->attach_type);