Daniel Borkmann
e06fa9c16c
bpf, sockmap: fix potential use after free in bpf_tcp_close ...
bpf_tcp_close() we pop the psock linkage to a map via psock_map_pop().
A parallel update on the sock hash map can happen between psock_map_pop()
and lookup_elem_raw() where we override the element under link->hash /
link->key. In bpf_tcp_close()'s lookup_elem_raw() we subsequently only
test whether an element is present, but we do not test whether the
element is infact the element we were looking for.
We lock the sock in bpf_tcp_close() during that time, so do we hold
the lock in sock_hash_update_elem(). However, the latter locks the
sock which is newly updated, not the one we're purging from the hash
table. This means that while one CPU is doing the lookup from bpf_tcp_close(),
another CPU is doing the map update in parallel, dropped our sock from
the hlist and released the psock.
Subsequently the first CPU will find the new sock and attempts to drop
and release the old sock yet another time. Fix is that we need to check
the elements for a match after lookup, similar as we do in the sock map.
Note that the hash tab elems are freed via RCU, so access to their
link->hash / link->key is fine since we're under RCU read side there.
Fixes: e9db4ef6bf
2018-08-27 20:22:05 -07:00
bpf, sockmap: fix potential use after free in bpf_tcp_close
2018-08-27 20:22:05 -07:00
Merge branch 'for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2018-08-24 13:19:27 -07:00
kconfig: tinyconfig: remove stale stack protector fixups
2018-06-15 07:15:28 +09:00
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
kernel/dma: remove unsupported gfp_mask parameter from dma_alloc_from_contiguous()
2018-08-17 16:20:32 -07:00
treewide: convert ISO_8859-1 text comments to utf-8
2018-08-23 18:48:43 -07:00
gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT
2018-06-08 18:56:02 +09:00
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 10:47:26 -07:00
Merge branch 'for-4.19/upstream' into for-linus
2018-08-20 18:33:50 +02:00
Updates for v4.19:
2018-08-20 18:32:00 -07:00
PM / sleep: wakeup: Fix build error caused by missing SRCU support
2018-08-15 00:07:08 +02:00
fbdev changes for v4.19:
2018-08-23 15:44:58 -07:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
Merge branch 'akpm' (patches from Andrew)
2018-08-22 12:34:08 -07:00
Merge branch 'siginfo-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-08-21 13:47:29 -07:00
Masami found an off by one bug in the code that keeps "notrace" functions
2018-08-23 13:07:00 -07:00
audit: use ktime_get_coarse_real_ts64() for timestamps
2018-07-17 14:45:08 -04:00
fsnotify: add fsnotify_add_inode_mark() wrappers
2018-05-18 14:58:22 +02:00
\n
2018-08-17 09:41:28 -07:00
audit: fix use-after-free in audit_add_watch
2018-07-18 11:43:36 -04:00
audit: rename FILTER_TYPE to FILTER_EXCLUDE
2018-06-19 10:39:54 -04:00
audit/stable-4.18 PR 20180814
2018-08-15 10:46:54 -07:00
time: Enable get/put_compat_itimerspec64 always
2018-06-24 14:39:47 +02:00
cpu/hotplug: Non-SMP machines do not make use of booted_once
2018-08-14 15:00:00 -07:00
kernel/crash_core.c: print timestamp using time64_t
2018-08-22 10:52:47 -07:00
delayacct: Use raw_spinlocks
2018-04-27 14:34:51 +02:00
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
signal: Pass pid type into group_send_sig_info
2018-07-21 12:57:35 -05:00
bpf/error-inject/kprobes: Clear current_kprobe and enable preempt in kprobe
2018-06-21 12:33:19 +02:00
Merge branch 'akpm' (patches from Andrew)
2018-08-22 12:34:08 -07:00
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex: Mark expected switch fall-throughs
2018-08-20 18:23:00 +02:00
kernel/hung_task.c: allow to set checking interval separately from timeout
2018-08-22 10:52:47 -07:00
memremap: split devm_memremap_pages() and memremap() infrastructure
2018-05-15 23:08:33 -07:00
jump_label: Disable jump labels in __exit code
2018-03-20 08:57:17 +01:00
kallsyms, x86: Export addresses of PTI entry trampolines
2018-08-14 19:12:29 -03:00
kconfig: include kernel/Kconfig.preempt from init/Kconfig
2018-08-02 08:06:54 +09:00
sched/core / kcov: avoid kcov_area during task switch
2018-06-15 07:55:24 +09:00
kexec: add call to LSM hook in original kexec_load syscall
2018-07-16 12:31:57 -07:00
kexec: yield to scheduler when loading kimage segments
2018-06-15 07:55:24 +09:00
treewide: Use array_size() in vzalloc()
2018-06-12 16:19:22 -07:00
kprobes: Replace %p with other pointer types
2018-06-21 17:33:42 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
kbuild: move bin2c back to scripts/ from scripts/basic/
2018-07-18 01:18:05 +09:00
libnvdimm-for-4.19_dax-memory-failure
2018-08-25 18:43:59 -07:00
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
module: use relative references for __ksymtab entries
2018-08-22 10:52:47 -07:00
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
Kbuild: rename CC_STACKPROTECTOR[_STRONG] config variables
2018-06-14 12:21:18 +09:00
kernel/params.c: downgrade warning for unsafe parameters
2018-04-11 10:28:37 -07:00
pid: Implement PIDTYPE_TGID
2018-07-21 10:43:12 -05:00
Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-04-03 19:15:32 -07:00
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
kernel/relay.c: change return type to vm_fault_t
2018-06-15 07:55:24 +09:00
libnvdimm for 4.18
2018-06-08 17:21:52 -07:00
rseq: uapi: Declare rseq_cs field as union, update includes
2018-07-10 22:18:52 +02:00
audit/stable-4.18 PR 20180605
2018-06-06 16:34:00 -07:00
Merge branch 'akpm' (patches from Andrew)
2018-08-22 12:34:08 -07:00
cpu/hotplug: Fix SMT supported evaluation
2018-08-07 12:25:30 +02:00
smpboot: Remove cpumask from the API
2018-07-03 09:20:44 +02:00
nohz: Fix missing tick reprogram when interrupting an inline softirq
2018-08-03 15:52:10 +02:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2018-08-24 09:25:39 -07:00
Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-06-10 10:17:09 -07:00
namei: allow restricted O_CREAT of FIFOs and regular files
2018-08-23 18:48:43 -07:00
staging: irda: remove remaining remants of irda code removal
2018-04-16 11:26:49 +02:00
kprobes: Remove jprobe API implementation
2018-06-21 12:33:05 +02:00
torture: Keep old-school dmesg format
2018-06-25 11:30:10 -07:00
kernel: tracepoints: add support for relative references
2018-08-22 10:52:47 -07:00
headers: untangle kmemleak.h from mm.h
2018-04-05 21:36:27 -07:00
fs: add do_fchownat(), ksys_fchown() helpers and ksys_{,l}chown() wrappers
2018-04-02 20:15:59 +02:00
kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c
2018-04-02 20:15:30 +02:00
umh: fix race condition
2018-06-07 16:56:28 -04:00
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
userns: move user access out of the mutex
2018-08-11 02:05:53 -05:00
uts: create "struct uts_namespace" from kmem_cache
2018-04-11 10:28:35 -07:00
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
watchdog/softlockup: Fix cpu_stop_queue_work() double-queue bug
2018-07-15 23:51:19 +02:00
watchdog: Reduce message verbosity
2018-08-03 12:19:08 +02:00
Merge branch 'for-4.19' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2018-08-24 13:16:36 -07:00
workqueue: Set worker->desc to workqueue name by default
2018-05-18 08:47:13 -07:00
e06fa9c16c