From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr720121.outbound.protection.outlook.com ([40.107.72.121]:64608 "EHLO NAM05-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1730115AbeIXUuu (ORCPT ); Mon, 24 Sep 2018 16:50:50 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Daniel Borkmann , Alexei Starovoitov , Sasha Levin Subject: [PATCH AUTOSEL 4.18 12/76] bpf, sockmap: fix psock refcount leak in bpf_tcp_recvmsg Date: Mon, 24 Sep 2018 14:48:07 +0000 Message-ID: <20180924144751.164410-12-alexander.levin@microsoft.com> References: <20180924144751.164410-1-alexander.levin@microsoft.com> In-Reply-To: <20180924144751.164410-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Daniel Borkmann [ Upstream commit 15c480efab01197c965ce0562a43ffedd852b8f9 ] In bpf_tcp_recvmsg() we first took a reference on the psock, however once we find that there are skbs in the normal socket's receive queue we return with processing them through tcp_recvmsg(). Problem is that we leak the taken reference on the psock in that path. Given we don't really do anything with the psock at this point, move the skb_queue_empty() test before we fetch the psock to fix this case. Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support") Signed-off-by: Daniel Borkmann Acked-by: John Fastabend Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/bpf/sockmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c index 7afa2a54ee34..e43730b52ea6 100644 --- a/kernel/bpf/sockmap.c +++ b/kernel/bpf/sockmap.c @@ -915,6 +915,8 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, =20 if (unlikely(flags & MSG_ERRQUEUE)) return inet_recv_error(sk, msg, len, addr_len); + if (!skb_queue_empty(&sk->sk_receive_queue)) + return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); =20 rcu_read_lock(); psock =3D smap_psock_sk(sk); @@ -925,9 +927,6 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msgh= dr *msg, size_t len, goto out; rcu_read_unlock(); =20 - if (!skb_queue_empty(&sk->sk_receive_queue)) - return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len); - lock_sock(sk); bytes_ready: while (copied !=3D len) { --=20 2.17.1