Patch "bpf: syzkaller found null ptr deref in unix_bpf proto add" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: syzkaller found null ptr deref in unix_bpf proto add

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-syzkaller-found-null-ptr-deref-in-unix_bpf-proto.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fcdd3e4c99cec46ec935976379c7b8c1b8fd4527
Author: John Fastabend <john.fastabend@xxxxxxxxx>
Date:   Fri Dec 1 10:01:38 2023 -0800

    bpf: syzkaller found null ptr deref in unix_bpf proto add
    
    [ Upstream commit 8d6650646ce49e9a5b8c5c23eb94f74b1749f70f ]
    
    I added logic to track the sock pair for stream_unix sockets so that we
    ensure lifetime of the sock matches the time a sockmap could reference
    the sock (see fixes tag). I forgot though that we allow af_unix unconnected
    sockets into a sock{map|hash} map.
    
    This is problematic because previous fixed expected sk_pair() to exist
    and did not NULL check it. Because unconnected sockets have a NULL
    sk_pair this resulted in the NULL ptr dereference found by syzkaller.
    
    BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
    Write of size 4 at addr 0000000000000080 by task syz-executor360/5073
    Call Trace:
     <TASK>
     ...
     sock_hold include/net/sock.h:777 [inline]
     unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
     sock_map_init_proto net/core/sock_map.c:190 [inline]
     sock_map_link+0xb87/0x1100 net/core/sock_map.c:294
     sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483
     sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577
     bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167
    
    We considered just checking for the null ptr and skipping taking a ref
    on the NULL peer sock. But, if the socket is then connected() after
    being added to the sockmap we can cause the original issue again. So
    instead this patch blocks adding af_unix sockets that are not in the
    ESTABLISHED state.
    
    Reported-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Reported-by: syzbot+e8030702aefd3444fb9e@xxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock")
    Acked-by: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx>
    Signed-off-by: John Fastabend <john.fastabend@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20231201180139.328529-2-john.fastabend@xxxxxxxxx
    Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/sock.h b/include/net/sock.h
index 7753354d59c0b..1b7ca8f35dd60 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2798,6 +2798,11 @@ static inline bool sk_is_tcp(const struct sock *sk)
 	return sk->sk_type == SOCK_STREAM && sk->sk_protocol == IPPROTO_TCP;
 }
 
+static inline bool sk_is_stream_unix(const struct sock *sk)
+{
+	return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM;
+}
+
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
  * @sk: socket to eat this skb from
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 4292c2ed18286..27d733c0f65e1 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -536,6 +536,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk)
 {
 	if (sk_is_tcp(sk))
 		return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN);
+	if (sk_is_stream_unix(sk))
+		return (1 << sk->sk_state) & TCPF_ESTABLISHED;
 	return true;
 }