• Sabrina Dubroca's avatar
    tcp: fix refcnt leak with ebpf congestion control · ebfa00c5
    Sabrina Dubroca authored
    There are a few bugs around refcnt handling in the new BPF congestion
    control setsockopt:
    
     - The new ca is assigned to icsk->icsk_ca_ops even in the case where we
       cannot get a reference on it. This would lead to a use after free,
       since that ca is going away soon.
    
     - Changing the congestion control case doesn't release the refcnt on
       the previous ca.
    
     - In the reinit case, we first leak a reference on the old ca, then we
       call tcp_reinit_congestion_control on the ca that we have just
       assigned, leading to deinitializing the wrong ca (->release of the
       new ca on the old ca's data) and releasing the refcount on the ca
       that we actually want to use.
    
    This is visible by building (for example) BIC as a module and setting
    net.ipv4.tcp_congestion_control=bic, and using tcp_cong_kern.c from
    samples/bpf.
    
    This patch fixes the refcount issues, and moves reinit back into tcp
    core to avoid passing a ca pointer back to BPF.
    
    Fixes: 91b5b21c ("bpf: Add support for changing congestion control")
    Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
    Acked-by: default avatarLawrence Brakmo <brakmo@fb.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ebfa00c5
tcp_cong.c 11.6 KB