bpf: skmsg, fix potential psock NULL pointer dereference

Report from Dan Carpenter,

 net/core/skmsg.c:792 sk_psock_write_space()
 error: we previously assumed 'psock' could be null (see line 790)

 net/core/skmsg.c
   789 psock = sk_psock(sk);
   790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
 Check for NULL
   791 schedule_work(&psock->work);
   792 write_space = psock->saved_write_space;
                     ^^^^^^^^^^^^^^^^^^^^^^^^
   793          rcu_read_unlock();
   794          write_space(sk);

Ensure psock dereference on line 792 only occurs if psock is not null.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index ad31e4e53d0a7186e9d2b7e5663c4c7bfa569fc3..a469d2124f3f24d260f7e0a1d04d338aefcefa64 100644 (file)
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -793,15 +793,18 @@ static void sk_psock_strp_data_ready(struct sock *sk)
 static void sk_psock_write_space(struct sock *sk)
 {
        struct sk_psock *psock;
-       void (*write_space)(struct sock *sk);
+       void (*write_space)(struct sock *sk) = NULL;
 
        rcu_read_lock();
        psock = sk_psock(sk);
-       if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
-               schedule_work(&psock->work);
-       write_space = psock->saved_write_space;
+       if (likely(psock)) {
+               if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
+                       schedule_work(&psock->work);
+               write_space = psock->saved_write_space;
+       }
        rcu_read_unlock();
-       write_space(sk);
+       if (write_space)
+               write_space(sk);
 }
 
 int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)