From: John Fastabend <john.fastabend@gmail.com>
To: Pengcheng Yang <yangpc@wangsu.com>,
bpf@vger.kernel.org, netdev@vger.kernel.org,
John Fastabend <john.fastabend@gmail.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Jakub Sitnicki <jakub@cloudflare.com>,
Lorenz Bauer <lmb@cloudflare.com>
Cc: Pengcheng Yang <yangpc@wangsu.com>
Subject: RE: [PATCH RESEND bpf 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
Date: Tue, 22 Nov 2022 18:50:49 -0800 [thread overview]
Message-ID: <637d8a89335ec_2b649208ca@john.notmuch> (raw)
In-Reply-To: <1669082309-2546-2-git-send-email-yangpc@wangsu.com>
Pengcheng Yang wrote:
> In tcp_bpf_send_verdict() redirection, the eval variable is assigned to
> __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data,
> sock_put() will be called multiple times.
> We should reset the eval variable to __SK_NONE every time more_data
> starts.
>
> This causes:
>
> IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110
> Modules linked in:
> CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1
> Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014
> Call Trace:
> <TASK>
> __tcp_transmit_skb+0xa1b/0xb90
> ? __alloc_skb+0x8c/0x1a0
> ? __kmalloc_node_track_caller+0x184/0x320
> tcp_write_xmit+0x22a/0x1110
> __tcp_push_pending_frames+0x32/0xf0
> do_tcp_sendpages+0x62d/0x640
> tcp_bpf_push+0xae/0x2c0
> tcp_bpf_sendmsg_redir+0x260/0x410
> ? preempt_count_add+0x70/0xa0
> tcp_bpf_send_verdict+0x386/0x4b0
> tcp_bpf_sendmsg+0x21b/0x3b0
> sock_sendmsg+0x58/0x70
> __sys_sendto+0xfa/0x170
> ? xfd_validate_state+0x1d/0x80
> ? switch_fpu_return+0x59/0xe0
> __x64_sys_sendto+0x24/0x30
> do_syscall_64+0x37/0x90
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Fixes: cd9733f5d75c ("tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function")
> Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
Thanks.
Acked-by: John Fastabend <john.fastabend@gmail.com>
next prev parent reply other threads:[~2022-11-23 2:50 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-22 1:58 [PATCH RESEND bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
2022-11-22 1:58 ` [PATCH RESEND bpf 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data Pengcheng Yang
2022-11-23 2:50 ` John Fastabend [this message]
2022-11-22 1:58 ` [PATCH RESEND bpf 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes Pengcheng Yang
2022-11-23 3:02 ` John Fastabend
2022-11-23 6:01 ` Pengcheng Yang
2022-11-28 11:22 ` Jakub Sitnicki
2022-11-28 18:18 ` John Fastabend
2022-11-29 19:16 ` Jakub Sitnicki
2022-11-29 8:02 ` Pengcheng Yang
2022-11-22 1:58 ` [PATCH RESEND bpf 3/4] bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect Pengcheng Yang
2022-11-22 1:58 ` [PATCH RESEND bpf 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes Pengcheng Yang
2022-11-23 3:05 ` John Fastabend
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=637d8a89335ec_2b649208ca@john.notmuch \
--to=john.fastabend@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=jakub@cloudflare.com \
--cc=lmb@cloudflare.com \
--cc=netdev@vger.kernel.org \
--cc=yangpc@wangsu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.