Martin KaFai Lau c9a368f1c0 bpf: net: Avoid incorrect bpf_sk_reuseport_detach call ... bpf_sk_reuseport_detach is currently called when sk->sk_user_data is not NULL. It is incorrect because sk->sk_user_data may not be managed by the bpf's reuseport_array. It has been reported in [1] that, the bpf_sk_reuseport_detach() which is called from udp_lib_unhash() has corrupted the sk_user_data managed by l2tp. This patch solves it by using another bit (defined as SK_USER_DATA_BPF) of the sk_user_data pointer value. It marks that a sk_user_data is managed/owned by BPF. The patch depends on a PTRMASK introduced in commit f1ff5ce2cd ("net, sk_msg: Clear sk_user_data pointer on clone if tagged"). [ Note: sk->sk_user_data is used by bpf's reuseport_array only when a sk is added to the bpf's reuseport_array. i.e. doing setsockopt(SO_REUSEPORT) and having "sk->sk_reuseport == 1" alone will not stop sk->sk_user_data being used by other means. ] [1]: https://lore.kernel.org/netdev/20200706121259.GA20199@katalix.com/ Fixes: 5dc4c4b7d4 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY") Reported-by: James Chapman <jchapman@katalix.com> Reported-by: syzbot+9f092552ba9a5efca5df@syzkaller.appspotmail.com Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: James Chapman <jchapman@katalix.com> Acked-by: James Chapman <jchapman@katalix.com> Link: https://lore.kernel.org/bpf/20200709061110.4019316-1-kafai@fb.com		2020-07-09 22:03:31 +02:00
..
acpi	Merge branch 'acpica'	2020-06-10 17:27:28 +02:00
asm-generic	mm: Allow arches to provide ptep_get()	2020-06-20 22:14:53 +10:00
clocksource
crypto
drm	drm/edid: Replace zero-length array with flexible-array	2020-06-15 23:08:31 -05:00
dt-bindings	- qcom :	2020-06-11 12:42:14 -07:00
keys	RxRPC: Replace zero-length array with flexible-array	2020-06-15 23:08:32 -05:00
kunit
kvm
linux	vlan: consolidate VLAN parsing code and limit max parsing depth	2020-07-07 15:48:38 -07:00
math-emu
media	media updates for v5.8-rc1	2020-06-13 13:09:38 -07:00
misc
net	bpf: net: Avoid incorrect bpf_sk_reuseport_detach call	2020-07-09 22:03:31 +02:00
pcmcia
ras
rdma	dynamic_debug: add an option to enable dynamic debug for modules only	2020-06-08 11:05:56 -07:00
scsi	SCSI misc on 20200605	2020-06-05 15:11:50 -07:00
soc	pci-v5.8-changes	2020-06-06 11:01:58 -07:00
sound	ASoC: Fixes for v5.8	2020-06-22 13:49:14 +02:00
target	scsi: target: Rename target_setup_cmd_from_cdb() to target_cmd_parse_cdb()	2020-06-09 21:57:26 -04:00
trace	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-06-25 18:27:40 -07:00
uapi	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf	2020-06-30 14:20:45 -07:00
vdso
video
xen	xen: Move xen_setup_callback_vector() definition to include/xen/hvm.h	2020-06-11 15:15:19 +02:00