On 10/27/24 10:58 PM, Yonghong Song wrote:
On 10/26/24 11:55 AM, Cong Wang wrote:From: Cong Wang <cong.wang@xxxxxxxxxxxxx> The following race condition could trigger a NULL pointer dereference: sock_map_link_detach(): sock_map_link_update_prog(): mutex_lock(&sockmap_mutex); ... sockmap_link->map = NULL; mutex_unlock(&sockmap_mutex); mutex_lock(&sockmap_mutex); ... sock_map_prog_link_lookup(sockmap_link->map); mutex_unlock(&sockmap_mutex); <continue> Fix it by adding a NULL pointer check. In this specific case, it makes no sense to update a link which is being released. Reported-by: Ruan Bonan <bonan.ruan@xxxxxxxxx> Fixes: 699c23f02c65 ("bpf: Add bpf_link support for sk_msg and sk_skb progs") Cc: Yonghong Song <yonghong.song@xxxxxxxxx> Cc: John Fastabend <john.fastabend@xxxxxxxxx> Cc: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> Signed-off-by: Cong Wang <cong.wang@xxxxxxxxxxxxx> --- net/core/sock_map.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/core/sock_map.c b/net/core/sock_map.c index 07d6aa4e39ef..9fca4db52f57 100644 --- a/net/core/sock_map.c +++ b/net/core/sock_map.c@@ -1760,6 +1760,10 @@ static int sock_map_link_update_prog(struct bpf_link *link,ret = -EINVAL; goto out; } + if (!sockmap_link->map) { + ret = -EINVAL;Thanks for the fix. Maybe we should use -ENOENT as the return error code? In this case, update_prog failed due to sockmap_link->map == NULL which is equivalent to no 'entry' to update.
The fix lgtm. Regarding the error value, the tcx/bpf_struct_ops/cgroup's update_prog uses -ENOLINK. I changed it to -ENOLINK for consistency. Applied. Thanks.
+ goto out; + } ret = sock_map_prog_link_lookup(sockmap_link->map, &pprog, &plink, sockmap_link->attach_type);
