Patch "xsk: Fix xsk_diag use-after-free error during socket cleanup" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    xsk: Fix xsk_diag use-after-free error during socket cleanup

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xsk-fix-xsk_diag-use-after-free-error-during-socket-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c848be58f3d687cb13a749fa08a308d565c0c8ce
Author: Magnus Karlsson <magnus.karlsson@xxxxxxxxx>
Date:   Thu Aug 31 12:01:17 2023 +0200

    xsk: Fix xsk_diag use-after-free error during socket cleanup
    
    [ Upstream commit 3e019d8a05a38abb5c85d4f1e85fda964610aa14 ]
    
    Fix a use-after-free error that is possible if the xsk_diag interface
    is used after the socket has been unbound from the device. This can
    happen either due to the socket being closed or the device
    disappearing. In the early days of AF_XDP, the way we tested that a
    socket was not bound to a device was to simply check if the netdevice
    pointer in the xsk socket structure was NULL. Later, a better system
    was introduced by having an explicit state variable in the xsk socket
    struct. For example, the state of a socket that is on the way to being
    closed and has been unbound from the device is XSK_UNBOUND.
    
    The commit in the Fixes tag below deleted the old way of signalling
    that a socket is unbound, setting dev to NULL. This in the belief that
    all code using the old way had been exterminated. That was
    unfortunately not true as the xsk diagnostics code was still using the
    old way and thus does not work as intended when a socket is going
    down. Fix this by introducing a test against the state variable. If
    the socket is in the state XSK_UNBOUND, simply abort the diagnostic's
    netlink operation.
    
    Fixes: 18b1ab7aa76b ("xsk: Fix race at socket teardown")
    Reported-by: syzbot+822d1359297e2694f873@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Magnus Karlsson <magnus.karlsson@xxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Tested-by: syzbot+822d1359297e2694f873@xxxxxxxxxxxxxxxxxxxxxxxxx
    Tested-by: Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230831100119.17408-1-magnus.karlsson@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/xdp/xsk_diag.c b/net/xdp/xsk_diag.c
index c014217f5fa7d..22b36c8143cfd 100644
--- a/net/xdp/xsk_diag.c
+++ b/net/xdp/xsk_diag.c
@@ -111,6 +111,9 @@ static int xsk_diag_fill(struct sock *sk, struct sk_buff *nlskb,
 	sock_diag_save_cookie(sk, msg->xdiag_cookie);
 
 	mutex_lock(&xs->mutex);
+	if (READ_ONCE(xs->state) == XSK_UNBOUND)
+		goto out_nlmsg_trim;
+
 	if ((req->xdiag_show & XDP_SHOW_INFO) && xsk_diag_put_info(xs, nlskb))
 		goto out_nlmsg_trim;