CVE-2024-36938

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue<br /> <br /> Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which<br /> syzbot reported [1].<br /> <br /> [1]<br /> BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue<br /> <br /> write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:<br /> sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]<br /> sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843<br /> sk_psock_put include/linux/skmsg.h:459 [inline]<br /> sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648<br /> unix_release+0x4b/0x80 net/unix/af_unix.c:1048<br /> __sock_release net/socket.c:659 [inline]<br /> sock_close+0x68/0x150 net/socket.c:1421<br /> __fput+0x2c1/0x660 fs/file_table.c:422<br /> __fput_sync+0x44/0x60 fs/file_table.c:507<br /> __do_sys_close fs/open.c:1556 [inline]<br /> __se_sys_close+0x101/0x1b0 fs/open.c:1541<br /> __x64_sys_close+0x1f/0x30 fs/open.c:1541<br /> do_syscall_64+0xd3/0x1d0<br /> entry_SYSCALL_64_after_hwframe+0x6d/0x75<br /> <br /> read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:<br /> sk_psock_data_ready include/linux/skmsg.h:464 [inline]<br /> sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555<br /> sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606<br /> sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]<br /> sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202<br /> unix_read_skb net/unix/af_unix.c:2546 [inline]<br /> unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682<br /> sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223<br /> unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339<br /> sock_sendmsg_nosec net/socket.c:730 [inline]<br /> __sock_sendmsg+0x140/0x180 net/socket.c:745<br /> ____sys_sendmsg+0x312/0x410 net/socket.c:2584<br /> ___sys_sendmsg net/socket.c:2638 [inline]<br /> __sys_sendmsg+0x1e9/0x280 net/socket.c:2667<br /> __do_sys_sendmsg net/socket.c:2676 [inline]<br /> __se_sys_sendmsg net/socket.c:2674 [inline]<br /> __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674<br /> do_syscall_64+0xd3/0x1d0<br /> entry_SYSCALL_64_after_hwframe+0x6d/0x75<br /> <br /> value changed: 0xffffffff83d7feb0 -&gt; 0x0000000000000000<br /> <br /> Reported by Kernel Concurrency Sanitizer on:<br /> CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024<br /> <br /> Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer<br /> dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer<br /> similarly due to no protection of saved_data_ready. Here is another<br /> different caller causing the same issue because of the same reason. So<br /> we should protect it with sk_callback_lock read lock because the writer<br /> side in the sk_psock_drop() uses "write_lock_bh(&amp;sk-&gt;sk_callback_lock);".<br /> <br /> To avoid errors that could happen in future, I move those two pairs of<br /> lock into the sk_psock_data_ready(), which is suggested by John Fastabend.