[PATCH net 0/2] tcp: fix congestion control UAFs in do_tcp_getsockopt()
"Cen Zhang (Microsoft)" <[email protected]>
| Newsgroups | org.kernel.vger.bpf,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
do_tcp_getsockopt() has two lockless reads of icsk_ca_ops. Since BPF struct_ops congestion control made icsk_ca_ops point to dynamically allocated memory, a concurrent setsockopt(TCP_CONGESTION) can replace the pointer and free the old object while either reader is using it. Patch 1 fixes the TCP_CONGESTION path by copying ca_ops->name to a stack buffer while holding rcu_read_lock(). Patch 2 fixes the TCP_CC_INFO path by keeping the ca_ops->get_info lookup and call inside an RCU read-side critical section. Eric Dumazet's related TCP data-race annotation work [1] adds READ_ONCE()/WRITE_ONCE() annotations for lockless TCP socket field accesses. icsk_ca_ops would similarly benefit from such annotations, but that is an independent data-race concern. This series focuses solely on the use-after-free fixes via rcu_read_lock(). [1] https://lore.kernel.org/all/[email protected]/ Cen Zhang (Microsoft) (2): tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) net/ipv4/tcp.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) base-commit: 746fc0787f616da418ffc04a110296fe95d53491 -- 2.55.0