From: John Fastabend <john.fastabend@gmail.com>

Date: Thu, 21 Nov 2019 08:25:09 -0800

Subject: bpf: skmsg, fix potential psock NULL pointer dereference

Patch-mainline: v5.5-rc1

Git-commit: 8163999db445021f2651a8a47b5632483e8722ea

References: bsc#1109837

Report from Dan Carpenter,

 net/core/skmsg.c:792 sk_psock_write_space()

 error: we previously assumed 'psock' could be null (see line 790)

 net/core/skmsg.c

   789 psock = sk_psock(sk);

   790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))

 Check for NULL

   791 schedule_work(&psock->work);

   792 write_space = psock->saved_write_space;

                     ^^^^^^^^^^^^^^^^^^^^^^^^

   793          rcu_read_unlock();

   794          write_space(sk);

Ensure psock dereference on line 792 only occurs if psock is not null.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")

Signed-off-by: John Fastabend <john.fastabend@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>

Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>

---

 net/core/skmsg.c |   13 ++++++++-----

 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/net/core/skmsg.c

+++ b/net/core/skmsg.c

@@ -757,15 +757,18 @@ static void sk_psock_strp_data_ready(str

 static void sk_psock_write_space(struct sock *sk)

 {

 	struct sk_psock *psock;

-	void (*write_space)(struct sock *sk);

+	void (*write_space)(struct sock *sk) = NULL;

 	rcu_read_lock();

 	psock = sk_psock(sk);

-	if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))

-		schedule_work(&psock->work);

-	write_space = psock->saved_write_space;

+	if (likely(psock)) {

+		if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))

+			schedule_work(&psock->work);

+		write_space = psock->saved_write_space;

+	}

 	rcu_read_unlock();

-	write_space(sk);

+	if (write_space)

+		write_space(sk);

 }

 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)