Re: [PATCH bpf v2] bpf: Fix the kernel crash caused by bpf_setsockopt().

[Martin KaFai Lau <martin.lau@linux.dev>]

On 1/26/23 4:17 PM, Kui-Feng Lee wrote:
> The kernel crash was caused by a BPF program attached to the
> "lsm_cgroup/socket_sock_rcv_skb" hook, which performed a call to
> `bpf_setsockopt()` in order to set the TCP_NODELAY flag as an
> example. Flags like TCP_NODELAY can prompt the kernel to flush a
> socket's outgoing queue, and this hook
> "lsm_cgroup/socket_sock_rcv_skb" is frequently triggered by
> softirqs. The issue was that in certain circumstances, when
> `tcp_write_xmit()` was called to flush the queue, it would also allow
> BH (bottom-half) to run. This could lead to our program attempting to
> flush the same socket recursively, which caused a `skbuf` to be
> unlinked twice.
> 
> `security_sock_rcv_skb()` is triggered by `tcp_filter()`. This occurs
> before the sock ownership is checked in `tcp_v4_rcv()`. Consequently,
> if a bpf program runs on `security_sock_rcv_skb()` while under softirq
> conditions, it may not possess the lock needed for `bpf_setsoppt()`,
> thus presenting an issue.

Fixed a few minor things like s/bpf_setsoppt/bpf_setsockopt/
and s/skbuf/skbuff/.

Applied. Thanks.