bpf: Sockmap/tls, push write_space updates through ulp updates

BugLink: https://bugs.launchpad.net/bugs/1862429
commit 33bfe20dd7117dd81fd896a53f743a233e1ad64f upstream.

When sockmap sock with TLS enabled is removed we cleanup bpf/psock state
and call tcp_update_ulp() to push updates to TLS ULP on top. However, we
don't push the write_space callback up and instead simply overwrite the
op with the psock stored previous op. This may or may not be correct so
to ensure we don't overwrite the TLS write space hook pass this field to
the ULP and have it fixup the ctx.

This completes a previous fix that pushed the ops through to the ULP
but at the time missed doing this for write_space, presumably because
write_space TLS hook was added around the same time.

Fixes: 95fa145479fbc ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20200111061206.8028-4-john.fastabend@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index cab8f3491c2bd5a54fb6af6751d796ba9545ea2a..7eb6a8754f19afd74252e08cca6a2ace7b79283f 100644 (file)
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -355,17 +355,21 @@ static inline void sk_psock_restore_proto(struct sock *sk,
                                          struct sk_psock *psock)
 {
        sk->sk_prot->unhash = psock->saved_unhash;
-       sk->sk_write_space = psock->saved_write_space;
 
        if (psock->sk_proto) {
                struct inet_connection_sock *icsk = inet_csk(sk);
                bool has_ulp = !!icsk->icsk_ulp_data;
 
-               if (has_ulp)
-                       tcp_update_ulp(sk, psock->sk_proto);
-               else
+               if (has_ulp) {
+                       tcp_update_ulp(sk, psock->sk_proto,
+                                      psock->saved_write_space);
+               } else {
                        sk->sk_prot = psock->sk_proto;
+                       sk->sk_write_space = psock->saved_write_space;
+               }
                psock->sk_proto = NULL;
+       } else {
+               sk->sk_write_space = psock->saved_write_space;
        }
 }
 

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 09910641fcc3f8d23bc1630283680c134315e243..520b80df35f8ebf1e74be8b6bf0fa85305db0515 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2120,7 +2120,8 @@ struct tcp_ulp_ops {
        /* initialize ulp */
        int (*init)(struct sock *sk);
        /* update ulp */
-       void (*update)(struct sock *sk, struct proto *p);
+       void (*update)(struct sock *sk, struct proto *p,
+                      void (*write_space)(struct sock *sk));
        /* cleanup ulp */
        void (*release)(struct sock *sk);
 
@@ -2132,7 +2133,8 @@ void tcp_unregister_ulp(struct tcp_ulp_ops *type);
 int tcp_set_ulp(struct sock *sk, const char *name);
 void tcp_get_available_ulp(char *buf, size_t len);
 void tcp_cleanup_ulp(struct sock *sk);
-void tcp_update_ulp(struct sock *sk, struct proto *p);
+void tcp_update_ulp(struct sock *sk, struct proto *p,
+                   void (*write_space)(struct sock *sk));
 
 #define MODULE_ALIAS_TCP_ULP(name)                             \
        __MODULE_INFO(alias, alias_userspace, name);            \

diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 4849edb62d52964c61ef2d0601c16baa662e196d..9168645b760e773f26b2b935e86fe574ebc5322d 100644 (file)
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -96,17 +96,19 @@ void tcp_get_available_ulp(char *buf, size_t maxlen)
        rcu_read_unlock();
 }
 
-void tcp_update_ulp(struct sock *sk, struct proto *proto)
+void tcp_update_ulp(struct sock *sk, struct proto *proto,
+                   void (*write_space)(struct sock *sk))
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
 
        if (!icsk->icsk_ulp_ops) {
+               sk->sk_write_space = write_space;
                sk->sk_prot = proto;
                return;
        }
 
        if (icsk->icsk_ulp_ops->update)
-               icsk->icsk_ulp_ops->update(sk, proto);
+               icsk->icsk_ulp_ops->update(sk, proto, write_space);
 }
 
 void tcp_cleanup_ulp(struct sock *sk)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 07476df4b13f3bd4ffd41a084682f74be08cf380..29c4a47fee33e8d5541048da0083b73141da3eed 100644 (file)
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -803,16 +803,19 @@ out:
        return rc;
 }
 
-static void tls_update(struct sock *sk, struct proto *p)
+static void tls_update(struct sock *sk, struct proto *p,
+                      void (*write_space)(struct sock *sk))
 {
        struct tls_context *ctx;
 
        ctx = tls_get_ctx(sk);
        if (likely(ctx)) {
+               ctx->sk_write_space = write_space;
                ctx->sk_proto_close = p->close;
                ctx->sk_proto = p;
        } else {
                sk->sk_prot = p;
+               sk->sk_write_space = write_space;
        }
 }