| Message ID | 20250331012126.1649720-2-dongchenchen2@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | bpf, sockmap: Avoid sk_prot reset on sockmap unlink with ULP set | expand |
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index ba581785adb4..01b3930947cc 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -708,6 +708,9 @@ int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) return 0; } + if (inet_csk_has_ulp(sk)) + return 0; + if (sk->sk_family == AF_INET6) { if (tcp_bpf_assert_proto_ops(psock->sk_proto)) return -EINVAL;
WARNING: CPU: 0 PID: 6558 at net/core/sock_map.c:1703 sock_map_close+0x3c4/0x480 Modules linked in: CPU: 0 UID: 0 PID: 6558 Comm: syz-executor.14 Not tainted 6.14.0-rc5+ #238 RIP: 0010:sock_map_close+0x3c4/0x480 Call Trace: <TASK> inet_release+0x144/0x280 __sock_release+0xb8/0x270 sock_close+0x1e/0x30 __fput+0x3c6/0xb30 __fput_sync+0x7b/0x90 __x64_sys_close+0x90/0x120 do_syscall_64+0x5d/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The root cause is: bpf_prog_attach(BPF_SK_SKB_STREAM_VERDICT) tcp_set_ulp //set ulp after sockmap add icsk->icsk_ulp_ops = ulp_ops; sock_hash_update_common sock_map_unref sock_map_del_link psock->psock_update_sk_prot(sk, psock, false); sk->sk_prot->close = sock_map_close sk_psock_drop sk_psock_restore_proto tcp_bpf_update_proto tls_update //not redo sk_prot to tcp prot inet_release sk->sk_prot->close sock_map_close WARN(sk->sk_prot->close == sock_map_close) commit e34a07c0ae39 ("sock: redo the psock vs ULP protection check") has moved ulp check from tcp_bpf_update_proto() to psock init. If sk sets ulp after being added to sockmap, it will reset sk_prot to BPF_BASE when removed from sockmap. After the psock is dropped, it will not reset sk_prot back to the tcp prot, only tls context update is performed. This can trigger a warning in sock_map_close() due to recursion of sk->sk_prot->close. To fix this issue, skip the sk_prot operations redo when deleting link from sockmap if ULP is set. Fixes: e34a07c0ae39 ("sock: redo the psock vs ULP protection check") Fixes: c0d95d3380ee ("bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap") Suggested-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> --- Changes for v2: - Move ULP check from sock_map_del_link() to tcp_bpf_update_proto() --- net/ipv4/tcp_bpf.c | 3 +++ 1 file changed, 3 insertions(+)