linux/include
John Fastabend bcc5b2d8a3 bpf: syzkaller found null ptr deref in unix_bpf proto add
[ Upstream commit 8d6650646c ]

I added logic to track the sock pair for stream_unix sockets so that we
ensure lifetime of the sock matches the time a sockmap could reference
the sock (see fixes tag). I forgot though that we allow af_unix unconnected
sockets into a sock{map|hash} map.

This is problematic because previous fixed expected sk_pair() to exist
and did not NULL check it. Because unconnected sockets have a NULL
sk_pair this resulted in the NULL ptr dereference found by syzkaller.

BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
Write of size 4 at addr 0000000000000080 by task syz-executor360/5073
Call Trace:
 <TASK>
 ...
 sock_hold include/net/sock.h:777 [inline]
 unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
 sock_map_init_proto net/core/sock_map.c:190 [inline]
 sock_map_link+0xb87/0x1100 net/core/sock_map.c:294
 sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483
 sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577
 bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167

We considered just checking for the null ptr and skipping taking a ref
on the NULL peer sock. But, if the socket is then connected() after
being added to the sockmap we can cause the original issue again. So
instead this patch blocks adding af_unix sockets that are not in the
ESTABLISHED state.

Reported-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+e8030702aefd3444fb9e@syzkaller.appspotmail.com
Fixes: 8866730aed ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock")
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20231201180139.328529-2-john.fastabend@gmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-01-01 12:42:28 +00:00
..
acpi ACPI: PM: Add acpi_device_fix_up_power_children() function 2023-12-03 07:33:07 +01:00
asm-generic asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation 2023-12-20 17:01:59 +01:00
clocksource
crypto This update includes the following changes: 2023-08-29 11:23:29 -07:00
drm drm: Update file owner during use 2024-01-01 12:42:25 +00:00
dt-bindings IOMMU Updates for Linux v6.6 2023-09-01 16:54:25 -07:00
keys
kunit - An extensive rework of kexec and crash Kconfig from Eric DeVolder 2023-08-29 14:53:51 -07:00
kvm KVM: arm64: timers: Correctly handle TGE flip with CNTPOFF_EL2 2023-10-12 16:55:21 +01:00
linux wifi: ieee80211: don't require protected vendor action frames 2024-01-01 12:42:26 +00:00
math-emu
media media: ipu-bridge: increase sensor_name size 2023-11-28 17:19:46 +00:00
memory
misc
net bpf: syzkaller found null ptr deref in unix_bpf proto add 2024-01-01 12:42:28 +00:00
pcmcia
ras
rdma RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz 2023-12-13 18:45:16 +01:00
rv rv: Set variable 'da_mon_##name' to static 2023-09-01 21:00:00 -04:00
scsi scsi: sd: Fix system start for ATA devices 2023-12-08 08:52:17 +01:00
soc firmware: tegra: Add suspend hook and reset BPMP IPC early on resume 2023-11-20 11:59:16 +01:00
sound ASoC: soc-dai: add flag to mute and unmute stream during trigger 2023-11-28 17:20:04 +00:00
target
trace rxrpc: Fix RTT determination to use any ACK as a source 2023-12-03 07:33:02 +01:00
uapi fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP 2023-12-20 17:01:51 +01:00
ufs Merge branch 'fixes' into misc 2023-09-02 08:25:19 +01:00
vdso
video fbdev: stifb: Make the STI next font pointer a 32-bit signed offset 2023-11-28 17:19:58 +00:00
xen arm/xen: remove lazy mode related definitions 2023-09-19 07:04:49 +02:00