Patch "bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-sockmap-fix-null-pointer-dereference-in-sk_psock.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b7955538434060b99101a56673962f0695f0da85
Author: Shigeru Yoshida <syoshida@xxxxxxxxxx>
Date:   Mon Feb 19 00:09:33 2024 +0900

    bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()
    
    [ Upstream commit 4cd12c6065dfcdeba10f49949bffcf383b3952d8 ]
    
    syzbot reported the following NULL pointer dereference issue [1]:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000000
      [...]
      RIP: 0010:0x0
      [...]
      Call Trace:
       <TASK>
       sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230
       unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293
       sock_sendmsg_nosec net/socket.c:730 [inline]
       __sock_sendmsg+0x221/0x270 net/socket.c:745
       ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584
       ___sys_sendmsg net/socket.c:2638 [inline]
       __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667
       do_syscall_64+0xf9/0x240
       entry_SYSCALL_64_after_hwframe+0x6f/0x77
    
    If sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called
    concurrently, psock->saved_data_ready can be NULL, causing the above issue.
    
    This patch fixes this issue by calling the appropriate data ready function
    using the sk_psock_data_ready() helper and protecting it from concurrency
    with sk->sk_callback_lock.
    
    Fixes: 6df7f764cd3c ("bpf, sockmap: Wake up polling after data copy")
    Reported-by: syzbot+fd7b34375c1c8ce29c93@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Shigeru Yoshida <syoshida@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Tested-by: syzbot+fd7b34375c1c8ce29c93@xxxxxxxxxxxxxxxxxxxxxxxxx
    Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
    Closes: https://syzkaller.appspot.com/bug?extid=fd7b34375c1c8ce29c93 [1]
    Link: https://lore.kernel.org/bpf/20240218150933.6004-1-syoshida@xxxxxxxxxx
    Stable-dep-of: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 4b851a43cb0b7..349a1d055a064 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -1223,8 +1223,11 @@ static void sk_psock_verdict_data_ready(struct sock *sk)
 
 		rcu_read_lock();
 		psock = sk_psock(sk);
-		if (psock)
-			psock->saved_data_ready(sk);
+		if (psock) {
+			read_lock_bh(&sk->sk_callback_lock);
+			sk_psock_data_ready(sk, psock);
+			read_unlock_bh(&sk->sk_callback_lock);
+		}
 		rcu_read_unlock();
 	}
 }