6.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang cong.wang@bytedance.com
[ Upstream commit 740be3b9a6d73336f8c7d540842d0831dc7a808b ]
The following race condition could trigger a NULL pointer dereference:
sock_map_link_detach(): sock_map_link_update_prog(): mutex_lock(&sockmap_mutex); ... sockmap_link->map = NULL; mutex_unlock(&sockmap_mutex); mutex_lock(&sockmap_mutex); ... sock_map_prog_link_lookup(sockmap_link->map); mutex_unlock(&sockmap_mutex); <continue>
Fix it by adding a NULL pointer check. In this specific case, it makes no sense to update a link which is being released.
Reported-by: Ruan Bonan bonan.ruan@u.nus.edu Fixes: 699c23f02c65 ("bpf: Add bpf_link support for sk_msg and sk_skb progs") Cc: Yonghong Song yonghong.song@linux.dev Cc: John Fastabend john.fastabend@gmail.com Cc: Jakub Sitnicki jakub@cloudflare.com Signed-off-by: Cong Wang cong.wang@bytedance.com Link: https://lore.kernel.org/r/20241026185522.338562-1-xiyou.wangcong@gmail.com Signed-off-by: Martin KaFai Lau martin.lau@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- net/core/sock_map.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/core/sock_map.c b/net/core/sock_map.c index 219fd8f1ca2a4..0550837775d5e 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -1771,6 +1771,10 @@ static int sock_map_link_update_prog(struct bpf_link *link, ret = -EINVAL; goto out; } + if (!sockmap_link->map) { + ret = -ENOLINK; + goto out; + }
ret = sock_map_prog_link_lookup(sockmap_link->map, &pprog, &plink, sockmap_link->attach_type);