socket, bpf: fix possible use after free
authorEric Dumazet <edumazet@google.com>
Mon, 2 Oct 2017 19:20:51 +0000 (12:20 -0700)
committerDavid S. Miller <davem@davemloft.net>
Mon, 2 Oct 2017 22:23:42 +0000 (15:23 -0700)
commiteefca20eb20c66b06cf5ed09b49b1a7caaa27b7b
tree49ff0df975ed5fc89db450ca9b17ed040c1f7939
parent4ee4553e861a2a7c4f5b045d9453729d837d4a7d
socket, bpf: fix possible use after free

Starting from linux-4.4, 3WHS no longer takes the listener lock.

Since this time, we might hit a use-after-free in sk_filter_charge(),
if the filter we got in the memcpy() of the listener content
just happened to be replaced by a thread changing listener BPF filter.

To fix this, we need to make sure the filter refcount is not already
zero before incrementing it again.

Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/core/filter.c
net/core/sock.c