diff options
author | Joe Stringer <joe@wand.net.nz> | 2020-03-30 01:53:40 +0300 |
---|---|---|
committer | Alexei Starovoitov <ast@kernel.org> | 2020-03-30 23:45:05 +0300 |
commit | 7ae215d23c12a939005f35d1848ca55b6109b9c0 (patch) | |
tree | bc88bf441433f5bf7a3d66610adb5d1ad1707390 /net/core/filter.c | |
parent | 71489e21d720a09388b565d60ef87ae993c10528 (diff) | |
download | linux-7ae215d23c12a939005f35d1848ca55b6109b9c0.tar.xz |
bpf: Don't refcount LISTEN sockets in sk_assign()
Avoid taking a reference on listen sockets by checking the socket type
in the sk_assign and in the corresponding skb_steal_sock() code in the
the transport layer, and by ensuring that the prefetch free (sock_pfree)
function uses the same logic to check whether the socket is refcounted.
Suggested-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Joe Stringer <joe@wand.net.nz>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200329225342.16317-4-joe@wand.net.nz
Diffstat (limited to 'net/core/filter.c')
-rw-r--r-- | net/core/filter.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index ac5c1633f8d2..7628b947dbc3 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -5401,8 +5401,7 @@ static const struct bpf_func_proto bpf_sk_lookup_udp_proto = { BPF_CALL_1(bpf_sk_release, struct sock *, sk) { - /* Only full sockets have sk->sk_flags. */ - if (!sk_fullsock(sk) || !sock_flag(sk, SOCK_RCU_FREE)) + if (sk_is_refcounted(sk)) sock_gen_put(sk); return 0; } @@ -5928,7 +5927,8 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags) return -ENETUNREACH; if (unlikely(sk->sk_reuseport)) return -ESOCKTNOSUPPORT; - if (unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) + if (sk_is_refcounted(sk) && + unlikely(!refcount_inc_not_zero(&sk->sk_refcnt))) return -ENOENT; skb_orphan(skb); |