bpf: Sockmap/tls, push write_space updates through ulp updates

When sockmap sock with TLS enabled is removed we cleanup bpf/psock state
and call tcp_update_ulp() to push updates to TLS ULP on top. However, we
don't push the write_space callback up and instead simply overwrite the
op with the psock stored previous op. This may or may not be correct so
to ensure we don't overwrite the TLS write space hook pass this field to
the ULP and have it fixup the ctx.

This completes a previous fix that pushed the ops through to the ULP
but at the time missed doing this for write_space, presumably because
write_space TLS hook was added around the same time.

Fixes: 8e0fd2340797f ("bpf: sockmap/tls, close can race with map free")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20200111061206.8028-4-john.fastabend@gmail.com

diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index b6afe01f8592282d01378a595018a7580bacc761..14d61bba0b79bd0e8cc48c24fc84970546537a4f 100644 (file)
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -359,17 +359,21 @@ static inline void sk_psock_restore_proto(struct sock *sk,
                                          struct sk_psock *psock)
 {
        sk->sk_prot->unhash = psock->saved_unhash;
-       sk->sk_write_space = psock->saved_write_space;
 
        if (psock->sk_proto) {
                struct inet_connection_sock *icsk = inet_csk(sk);
                bool has_ulp = !!icsk->icsk_ulp_data;
 
-               if (has_ulp)
-                       tcp_update_ulp(sk, psock->sk_proto);
-               else
+               if (has_ulp) {
+                       tcp_update_ulp(sk, psock->sk_proto,
+                                      psock->saved_write_space);
+               } else {
                        sk->sk_prot = psock->sk_proto;
+                       sk->sk_write_space = psock->saved_write_space;
+               }
                psock->sk_proto = NULL;
+       } else {
+               sk->sk_write_space = psock->saved_write_space;
        }
 }
 

diff --git a/include/net/tcp.h b/include/net/tcp.h
index e460ea7f767ba627972a63a974cae80357808366..e6f48384dc7119cae21ef46c74532e0f2577d8a2 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2147,7 +2147,8 @@ struct tcp_ulp_ops {
        /* initialize ulp */
        int (*init)(struct sock *sk);
        /* update ulp */
-       void (*update)(struct sock *sk, struct proto *p);
+       void (*update)(struct sock *sk, struct proto *p,
+                      void (*write_space)(struct sock *sk));
        /* cleanup ulp */
        void (*release)(struct sock *sk);
        /* diagnostic */
@@ -2162,7 +2163,8 @@ void tcp_unregister_ulp(struct tcp_ulp_ops *type);
 int tcp_set_ulp(struct sock *sk, const char *name);
 void tcp_get_available_ulp(char *buf, size_t len);
 void tcp_cleanup_ulp(struct sock *sk);
-void tcp_update_ulp(struct sock *sk, struct proto *p);
+void tcp_update_ulp(struct sock *sk, struct proto *p,
+                   void (*write_space)(struct sock *sk));
 
 #define MODULE_ALIAS_TCP_ULP(name)                             \
        __MODULE_INFO(alias, alias_userspace, name);            \

diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 12ab5db2b71cb5781fd9517d944138e1cecbd5dc..38d3ad1411611ef6002a9843ec7699a860f1485a 100644 (file)
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -99,17 +99,19 @@ void tcp_get_available_ulp(char *buf, size_t maxlen)
        rcu_read_unlock();
 }
 
-void tcp_update_ulp(struct sock *sk, struct proto *proto)
+void tcp_update_ulp(struct sock *sk, struct proto *proto,
+                   void (*write_space)(struct sock *sk))
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
 
        if (!icsk->icsk_ulp_ops) {
+               sk->sk_write_space = write_space;
                sk->sk_prot = proto;
                return;
        }
 
        if (icsk->icsk_ulp_ops->update)
-               icsk->icsk_ulp_ops->update(sk, proto);
+               icsk->icsk_ulp_ops->update(sk, proto, write_space);
 }
 
 void tcp_cleanup_ulp(struct sock *sk)

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index dac24c7aa7d4bb45b3188dae3fb1f6030cd3c299..94774c0e5ff32706dc1a36ebc3133dadde218501 100644 (file)
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -732,15 +732,19 @@ out:
        return rc;
 }
 
-static void tls_update(struct sock *sk, struct proto *p)
+static void tls_update(struct sock *sk, struct proto *p,
+                      void (*write_space)(struct sock *sk))
 {
        struct tls_context *ctx;
 
        ctx = tls_get_ctx(sk);
-       if (likely(ctx))
+       if (likely(ctx)) {
+               ctx->sk_write_space = write_space;
                ctx->sk_proto = p;
-       else
+       } else {
                sk->sk_prot = p;
+               sk->sk_write_space = write_space;
+       }
 }
 
 static int tls_get_info(const struct sock *sk, struct sk_buff *skb)