Martin KaFai Lau c9a368f1c0 bpf: net: Avoid incorrect bpf_sk_reuseport_detach call ... bpf_sk_reuseport_detach is currently called when sk->sk_user_data is not NULL. It is incorrect because sk->sk_user_data may not be managed by the bpf's reuseport_array. It has been reported in [1] that, the bpf_sk_reuseport_detach() which is called from udp_lib_unhash() has corrupted the sk_user_data managed by l2tp. This patch solves it by using another bit (defined as SK_USER_DATA_BPF) of the sk_user_data pointer value. It marks that a sk_user_data is managed/owned by BPF. The patch depends on a PTRMASK introduced in commit f1ff5ce2cd ("net, sk_msg: Clear sk_user_data pointer on clone if tagged"). [ Note: sk->sk_user_data is used by bpf's reuseport_array only when a sk is added to the bpf's reuseport_array. i.e. doing setsockopt(SO_REUSEPORT) and having "sk->sk_reuseport == 1" alone will not stop sk->sk_user_data being used by other means. ] [1]: https://lore.kernel.org/netdev/20200706121259.GA20199@katalix.com/ Fixes: 5dc4c4b7d4 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY") Reported-by: James Chapman <jchapman@katalix.com> Reported-by: syzbot+9f092552ba9a5efca5df@syzkaller.appspotmail.com Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: James Chapman <jchapman@katalix.com> Acked-by: James Chapman <jchapman@katalix.com> Link: https://lore.kernel.org/bpf/20200709061110.4019316-1-kafai@fb.com		2020-07-09 22:03:31 +02:00
..
9p	…
bluetooth	Bluetooth: Consolidate encryption handling in hci_encrypt_cfm	2020-05-20 16:30:33 +02:00
caif	…
iucv	net/af_iucv: clean up function prototypes	2020-05-19 12:50:14 -07:00
netfilter	netfilter: flowtable: Make nf_flow_table_offload_add/del_cb inline	2020-06-15 18:06:52 -07:00
netns	bpf, netns: Keep a list of attached bpf_link's	2020-06-30 10:45:08 -07:00
nfc	…
phonet	…
sctp	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket	2020-06-25 16:11:33 -07:00
tc_act	net/sched: act_ct: Make tcf_ct_flow_table_restore_skb inline	2020-06-15 18:06:52 -07:00
6lowpan.h	…
Space.h	…
act_api.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-05-24 13:47:27 -07:00
addrconf.h	…
af_ieee802154.h	…
af_rxrpc.h	rxrpc: add rxrpc_sock_set_min_security_level	2020-05-28 11:11:46 -07:00
af_unix.h	…
af_vsock.h	…
ah.h	…
arp.h	…
atmclip.h	…
ax25.h	…
ax88796.h	…
bareudp.h	net: Add netif_is_bareudp() API to identify bareudp devices	2020-05-22 16:46:16 -07:00
bond_3ad.h	…
bond_alb.h	…
bond_options.h	…
bonding.h	Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux	2020-05-09 01:05:30 -07:00
bpf_sk_storage.h	…
busy_poll.h	…
calipso.h	…
cfg80211-wext.h	…
cfg80211.h	cfg80211: fix management registrations deadlock	2020-06-05 09:22:00 +02:00
cfg802154.h	…
checksum.h	default csum_and_copy_to_user(): don't bother with access_ok()	2020-05-29 16:11:50 -04:00
cipso_ipv4.h	…
cls_cgroup.h	…
codel.h	…
codel_impl.h	…
codel_qdisc.h	…
compat.h	get rid of compat_mc_setsockopt()	2020-05-20 20:31:32 -04:00
datalink.h	…
dcbevent.h	…
dcbnl.h	…
devlink.h	devlink: Add ACL control packet traps	2020-06-01 11:49:23 -07:00
dn.h	…
dn_dev.h	…
dn_fib.h	…
dn_neigh.h	…
dn_nsp.h	…
dn_route.h	…
drop_monitor.h	…
dsa.h	net: dsa: provide an option for drivers to always receive bridge VLANs	2020-05-12 13:08:07 -07:00
dsfield.h	…
dst.h	net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb	2020-07-07 15:33:28 -07:00
dst_cache.h	…
dst_metadata.h	…
dst_ops.h	net/dst: use a smaller percpu_counter batch for dst entries accounting	2020-05-08 21:33:33 -07:00
erspan.h	…
esp.h	…
espintcp.h	…
ethoc.h	…
failover.h	…
fib_notifier.h	…
fib_rules.h	…
firewire.h	…
flow.h	…
flow_dissector.h	flow_dissector: Pull BPF program assignment up to bpf-netns	2020-06-30 10:45:07 -07:00
flow_offload.h	net: flow_offload: fix flow_indr_dev_unregister path	2020-06-19 20:12:58 -07:00
fou.h	…
fq.h	…
fq_impl.h	…
garp.h	…
gen_stats.h	…
genetlink.h	genetlink: remove genl_bind	2020-07-01 15:49:11 -07:00
geneve.h	…
gre.h	…
gro_cells.h	…
gtp.h	…
gue.h	GUE: Fix a typo	2020-06-22 21:12:44 -07:00
hwbm.h	…
icmp.h	…
ieee80211_radiotap.h	…
ieee802154_netdev.h	…
if_inet6.h	ipv6: Replace zero-length array with flexible-array	2020-05-11 13:18:54 -07:00
ife.h	…
ila.h	…
inet6_connection_sock.h	…
inet6_hashtables.h	…
inet_common.h	bpf: Allow any port in bpf_bind helper	2020-05-09 00:48:20 +02:00
inet_connection_sock.h	inet_connection_sock: clear inet_num out of destroy helper	2020-06-04 15:59:56 -07:00
inet_ecn.h	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
inet_frag.h	…
inet_hashtables.h	dccp: Fix possible memleak in dccp_init and dccp_fini	2020-06-09 13:26:23 -07:00
inet_sock.h	…
inet_timewait_sock.h	…
inetpeer.h	…
ip.h	ipv4: add ip_sock_set_pktinfo	2020-05-28 11:11:45 -07:00
ip6_checksum.h	…
ip6_fib.h	nexthop: support for fdb ecmp nexthops	2020-05-22 14:00:38 -07:00
ip6_route.h	ipv6: lift copy_from_user out of ipv6_route_ioctl	2020-05-18 17:35:02 -07:00
ip6_tunnel.h	…
ip_fib.h	ipv4: nexthop version of fib_info_nh_uses_dev	2020-05-26 16:06:07 -07:00
ip_tunnels.h	net: ip_tunnel: add header_ops for layer 3 devices	2020-06-30 12:29:39 -07:00
ip_vs.h	…
ipcomp.h	…
ipconfig.h	…
ipv6.h	ipv6: add ip6_sock_set_recvpktinfo	2020-05-28 11:11:46 -07:00
ipv6_frag.h	…
ipv6_stubs.h	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2020-05-29 13:02:33 -07:00
ipx.h	…
iw_handler.h	…
kcm.h	…
l3mdev.h	…
lag.h	…
lapb.h	…
lib80211.h	…
llc.h	…
llc_c_ac.h	…
llc_c_ev.h	…
llc_c_st.h	…
llc_conn.h	…
llc_if.h	…
llc_pdu.h	…
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
lwtunnel.h	…
mac80211.h	mac80211: use HE 6 GHz band capability and pass it to the driver	2020-05-31 11:27:03 +02:00
mac802154.h	…
macsec.h	…
mip6.h	…
mld.h	…
mpls.h	net: Make mpls_entry_encode() available for generic users	2020-05-29 21:20:20 -07:00
mpls_iptunnel.h	…
mptcp.h	mptcp: Use 32-bit DATA_ACK when possible	2020-05-16 13:51:10 -07:00
mrp.h	…
ncsi.h	…
ndisc.h	…
neighbour.h	net/sysctl: remove leftover __user annotations on neigh_proc_dointvec*	2020-06-08 10:13:56 -04:00
net_failover.h	…
net_namespace.h	net: Introduce netns_bpf for BPF programs attached to netns	2020-06-01 15:21:02 -07:00
net_ratelimit.h	…
netevent.h	…
netlabel.h	…
netlink.h	…
netprio_cgroup.h	…
netrom.h	…
nexthop.h	vxlan: Remove access to nexthop group struct	2020-06-10 13:20:20 -07:00
nl802154.h	…
nsh.h	…
p8022.h	…
page_pool.h	…
pie.h	…
ping.h	…
pkt_cls.h	net: sched: implement terse dump support in act	2020-05-15 10:23:11 -07:00
pkt_sched.h	sched: consistently handle layer3 header accesses in the presence of VLANs	2020-07-03 14:34:53 -07:00
pptp.h	…
protocol.h	…
psample.h	…
psnap.h	…
raw.h	…
rawv6.h	…
red.h	…
regulatory.h	…
request_sock.h	…
rose.h	…
route.h	…
rpl.h	…
rsi_91x.h	…
rtnetlink.h	…
rtnh.h	…
sch_generic.h	net: sched: introduce terse dump flag	2020-05-15 10:23:11 -07:00
scm.h	…
secure_seq.h	…
seg6.h	seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds	2020-06-04 15:39:32 -07:00
seg6_hmac.h	…
seg6_local.h	…
slhc_vj.h	…
smc.h	…
snmp.h	…
sock.h	bpf: net: Avoid incorrect bpf_sk_reuseport_detach call	2020-07-09 22:03:31 +02:00
sock_reuseport.h	…
stp.h	…
strparser.h	…
switchdev.h	bridge: mrp: Add support for role MRA	2020-06-01 11:56:11 -07:00
tcp.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-06-03 16:27:18 -07:00
tcp_states.h	…
timewait_sock.h	…
tipc.h	…
tls.h	bpf: Fix running sk_skb program types with ktls	2020-06-01 14:48:32 -07:00
tls_toe.h	…
transp_v6.h	…
tso.h	…
tun_proto.h	…
udp.h	…
udp_tunnel.h	net: bareudp: avoid uninitialized variable warning	2020-05-07 17:28:18 -07:00
udplite.h	…
vsock_addr.h	…
vxlan.h	vxlan: ecmp support for mac fdb entries	2020-05-22 14:00:38 -07:00
wext.h	…
wimax.h	…
x25.h	…
x25device.h	…
xdp.h	xdp: Rename convert_to_xdp_frame in xdp_convert_buff_to_frame	2020-06-01 15:02:53 -07:00
xdp_priv.h	…
xdp_sock.h	xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code	2020-05-21 17:31:27 -07:00
xdp_sock_drv.h	xsk: Remove MEM_TYPE_ZERO_COPY and corresponding code	2020-05-21 17:31:27 -07:00
xfrm.h	xfrm: Fix double ESP trailer insertion in IPsec crypto offload.	2020-06-04 10:45:14 +02:00
xsk_buff_pool.h	xsk: Replace the cheap_dma flag with a dma_need_sync flag	2020-06-30 15:44:03 +02:00