Re: [PATCH net] tcp: fix refcnt leak with ebpf congestion control

[David Miller <davem@davemloft.net>]

From: Sabrina Dubroca <sd@queasysnail.net>
Date: Fri, 25 Aug 2017 13:10:12 +0200

> There are a few bugs around refcnt handling in the new BPF congestion
> control setsockopt:
> 
>  - The new ca is assigned to icsk->icsk_ca_ops even in the case where we
>    cannot get a reference on it. This would lead to a use after free,
>    since that ca is going away soon.
> 
>  - Changing the congestion control case doesn't release the refcnt on
>    the previous ca.
> 
>  - In the reinit case, we first leak a reference on the old ca, then we
>    call tcp_reinit_congestion_control on the ca that we have just
>    assigned, leading to deinitializing the wrong ca (->release of the
>    new ca on the old ca's data) and releasing the refcount on the ca
>    that we actually want to use.
> 
> This is visible by building (for example) BIC as a module and setting
> net.ipv4.tcp_congestion_control=bic, and using tcp_cong_kern.c from
> samples/bpf.
> 
> This patch fixes the refcount issues, and moves reinit back into tcp
> core to avoid passing a ca pointer back to BPF.
> 
> Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>

Applied, thank you.