bpf, sockmap: Fix some issues with using apply_bytes #4080
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Upstream branch: 8be602d |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
509bb52
to
cf85bc9
Compare
kernel-patches-bot
force-pushed
the
bpf_base
branch
from
881fc52
to
0ebdd29
Compare
|
Upstream branch: 8be602d |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
cf85bc9
to
5143d8d
Compare
|
Upstream branch: 8be602d |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
5143d8d
to
fbe623c
Compare
|
Upstream branch: 8be602d |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
fbe623c
to
55bd175
Compare
kernel-patches-bot
force-pushed
the
bpf_base
branch
from
0ebdd29
to
429d996
Compare
|
Upstream branch: e493bec |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
55bd175
to
fea24e8
Compare
kernel-patches-bot
force-pushed
the
bpf_base
branch
from
429d996
to
7e647c3
Compare
|
Upstream branch: d66233a |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
fea24e8
to
24dd6c5
Compare
kernel-patches-bot
force-pushed
the
bpf_base
branch
from
7e647c3
to
c0864d5
Compare
added 3 commits
November 29, 2022 14:16
In tcp_bpf_send_verdict() redirection, the eval variable is assigned to __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data, sock_put() will be called multiple times. We should reset the eval variable to __SK_NONE every time more_data starts. This causes: IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7 ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110 Modules linked in: CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1 Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK> __tcp_transmit_skb+0xa1b/0xb90 ? __alloc_skb+0x8c/0x1a0 ? __kmalloc_node_track_caller+0x184/0x320 tcp_write_xmit+0x22a/0x1110 __tcp_push_pending_frames+0x32/0xf0 do_tcp_sendpages+0x62d/0x640 tcp_bpf_push+0xae/0x2c0 tcp_bpf_sendmsg_redir+0x260/0x410 ? preempt_count_add+0x70/0xa0 tcp_bpf_send_verdict+0x386/0x4b0 tcp_bpf_sendmsg+0x21b/0x3b0 sock_sendmsg+0x58/0x70 __sys_sendto+0xfa/0x170 ? xfd_validate_state+0x1d/0x80 ? switch_fpu_return+0x59/0xe0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: cd9733f ("tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function") Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
When redirecting, we use sk_msg_to_ingress() to get the BPF_F_INGRESS flag from the msg->flags. If apply_bytes is used and it is larger than the current data being processed, sk_psock_msg_verdict() will not be called when sendmsg() is called again. At this time, the msg->flags is 0, and we lost the BPF_F_INGRESS flag. So we need to save the BPF_F_INGRESS flag in sk_psock and use it when redirection. Fixes: 8934ce2 ("bpf: sockmap redirect ingress support") Signed-off-by: Pengcheng Yang <yangpc@wangsu.com> Cc: John Fastabend <john.fastabend@gmail.com> Cc: Jakub Sitnicki <jakub@cloudflare.com>
…direct Use apply_bytes on ingress redirect, when apply_bytes is less than the length of msg data, some data may be skipped and lost in bpf_tcp_ingress(). If there is still data in the scatterlist that has not been consumed, we cannot move the msg iter. Fixes: 604326b ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
Currently, the ingress redirect is not covered in "txmsg test apply". Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
|
Upstream branch: 01f856a |
kernel-patches-bot
force-pushed
the
series/695955=>bpf
branch
from
24dd6c5
to
1a6d4c8
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=700036 irrelevant now. Closing PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull request for series with
subject: bpf, sockmap: Fix some issues with using apply_bytes
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=697886