Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-28 Thread Daniel Borkmann
On 05/28/2018 05:13 PM, John Fastabend wrote: > On 05/27/2018 03:36 PM, Daniel Borkmann wrote: >> On 05/25/2018 07:37 PM, John Fastabend wrote: >>> syzbot reported two related splats, a use after free and null >>> pointer dereference, when a TCP socket is closed while the map is >>> also being remo

Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-28 Thread John Fastabend
On 05/27/2018 03:36 PM, Daniel Borkmann wrote: > On 05/25/2018 07:37 PM, John Fastabend wrote: >> syzbot reported two related splats, a use after free and null >> pointer dereference, when a TCP socket is closed while the map is >> also being removed. >> >> The psock keeps a reference to all map sl

Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-27 Thread Daniel Borkmann
On 05/25/2018 07:37 PM, John Fastabend wrote: > syzbot reported two related splats, a use after free and null > pointer dereference, when a TCP socket is closed while the map is > also being removed. > > The psock keeps a reference to all map slots that have a reference > to the sock so that when

Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-26 Thread John Fastabend
On 05/26/2018 01:30 AM, Daniel Borkmann wrote: > Hi John, > > On 05/25/2018 07:37 PM, John Fastabend wrote: >> syzbot reported two related splats, a use after free and null >> pointer dereference, when a TCP socket is closed while the map is >> also being removed. >> >> The psock keeps a reference

Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-26 Thread Daniel Borkmann
Hi John, On 05/25/2018 07:37 PM, John Fastabend wrote: > syzbot reported two related splats, a use after free and null > pointer dereference, when a TCP socket is closed while the map is > also being removed. > > The psock keeps a reference to all map slots that have a reference > to the sock so

Re: [bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-25 Thread Song Liu
On Fri, May 25, 2018 at 10:37 AM, John Fastabend wrote: > syzbot reported two related splats, a use after free and null > pointer dereference, when a TCP socket is closed while the map is > also being removed. > > The psock keeps a reference to all map slots that have a reference > to the sock so

[bpf-next PATCH] bpf: sockhash fix race with bpf_tcp_close and map delete

2018-05-25 Thread John Fastabend
syzbot reported two related splats, a use after free and null pointer dereference, when a TCP socket is closed while the map is also being removed. The psock keeps a reference to all map slots that have a reference to the sock so that when the sock is closed we can clean up any outstanding sock{ma