From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-111.freemail.mail.aliyun.com (out30-111.freemail.mail.aliyun.com [115.124.30.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C73084A39; Mon, 1 Jul 2024 09:08:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.111 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719824891; cv=none; b=OFjbGYcuLPjCfGrsaNVp0B4/lX60XoFjVDY+ZkO8XjHzVbbQobwedSYvkTo6jBs8FODY+D/g+oBP0IqhzVdOed3Rctk+NIq5Gp47l7+u/3RrgF8Yo0sgw03Nt6O8uUnQM3Sr57ZEtne/tJDuuOFt1T31lXP+x49VvabopC+02QA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719824891; c=relaxed/simple; bh=UGbdqgf/9Fvo9l2zX/CGYhdGSnuNCps876YVS1NTX9M=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ARe1t+LB1AFopbpbRILY/4t7kvNSrrsKqSbJfhOai5uf8obrb1WjZ2Qt+b5dozataiXF7+x0kwb5QV5cUq7ejSyMJfY5t56ww4j5hijYpdMyUZCQ72xnoXuYc1bH4+x8Q7O7ZM8Th8DpCdoEG8rEAFtnG7Lz4S1IhUqtH6cjwhs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=HX8xRUjL; arc=none smtp.client-ip=115.124.30.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="HX8xRUjL" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1719824886; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=FRI1Dyi5c7hnorQrmeEYTjeSPUtzZqzzroY7gFiFk8s=; b=HX8xRUjLPs6W4cmJQ1ztNB0NysfB+OSgNgnX/XyyCo94FEas0rdfZwx9lAeGTQ8BEw2dJqMhpqi5mrabPiWDV9OFUurkkcb1YYHzHc8KBo5WjBfpdXvZmkPZ4HNe1MlPvcHWPhts/3JN/SnQwUsoGDOk84aM9IBb82ai6L7jm8Q= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R101e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033068173054;MF=alibuda@linux.alibaba.com;NM=1;PH=DS;RN=29;SR=0;TI=SMTPD_---0W9cYRWS_1719824883; Received: from 30.221.145.205(mailfrom:alibuda@linux.alibaba.com fp:SMTPD_---0W9cYRWS_1719824883) by smtp.aliyun-inc.com; Mon, 01 Jul 2024 17:08:04 +0800 Message-ID: Date: Mon, 1 Jul 2024 17:08:02 +0800 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net v3 1/2] skmsg: prevent empty ingress skb from enqueuing To: Geliang Tang , John Fastabend , Jakub Sitnicki , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Alexei Starovoitov , Daniel Borkmann Cc: Geliang Tang , David Ahern , Eduard Zingerman , Mykola Lysenko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Shuah Khan , Mykyta Yatsenko , Miao Xu , Yuran Pereira , Huacai Chen , Tiezhu Yang , netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org References: <5b6a55017ab616131f7de1268b60cb34e99941a1.1719553101.git.tanggeliang@kylinos.cn> Content-Language: en-US From: "D. Wythe" In-Reply-To: <5b6a55017ab616131f7de1268b60cb34e99941a1.1719553101.git.tanggeliang@kylinos.cn> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 6/28/24 1:47 PM, Geliang Tang wrote: > From: Geliang Tang > > Run this BPF selftests (./test_progs -t sockmap_basic) on a Loongarch > platform, a Kernel panic occurs: > > ''' > Oops[#1]: > CPU: 22 PID: 2824 Comm: test_progs Tainted: G OE 6.10.0-rc2+ #18 > Hardware name: LOONGSON Dabieshan/Loongson-TC542F0, BIOS Loongson-UDK2018 > ... ... > ra: 90000000048bf6c0 sk_msg_recvmsg+0x120/0x560 > ERA: 9000000004162774 copy_page_to_iter+0x74/0x1c0 > CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) > PRMD: 0000000c (PPLV0 +PIE +PWE) > EUEN: 00000007 (+FPE +SXE +ASXE -BTE) > ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) > ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) > BADV: 0000000000000040 > PRID: 0014c011 (Loongson-64bit, Loongson-3C5000) > Modules linked in: bpf_testmod(OE) xt_CHECKSUM xt_MASQUERADE xt_conntrack > Process test_progs (pid: 2824, threadinfo=0000000000863a31, task=...) > Stack : ... > ... > Call Trace: > [<9000000004162774>] copy_page_to_iter+0x74/0x1c0 > [<90000000048bf6c0>] sk_msg_recvmsg+0x120/0x560 > [<90000000049f2b90>] tcp_bpf_recvmsg_parser+0x170/0x4e0 > [<90000000049aae34>] inet_recvmsg+0x54/0x100 > [<900000000481ad5c>] sock_recvmsg+0x7c/0xe0 > [<900000000481e1a8>] __sys_recvfrom+0x108/0x1c0 > [<900000000481e27c>] sys_recvfrom+0x1c/0x40 > [<9000000004c076ec>] do_syscall+0x8c/0xc0 > [<9000000003731da4>] handle_syscall+0xc4/0x160 > > Code: ... > > ---[ end trace 0000000000000000 ]--- > Kernel panic - not syncing: Fatal exception > Kernel relocated by 0x3510000 > .text @ 0x9000000003710000 > .data @ 0x9000000004d70000 > .bss @ 0x9000000006469400 > ---[ end Kernel panic - not syncing: Fatal exception ]--- > ''' > > This crash happens every time when running sockmap_skb_verdict_shutdown > subtest in sockmap_basic. > > This crash is because a NULL pointer is passed to page_address() in > sk_msg_recvmsg(). Due to the difference in architecture, page_address(0) > will not trigger a panic on the X86 platform but will panic on the > Loogarch platform. So this bug was hidden on the x86 platform, but now > it is exposed on the Loogarch platform. Maybe Loongarch ? Besides that, LGTM. Reviewed-by: D. Wythe > > The root cause is an empty skb (skb->len == 0) is put on the queue. > > In this case, in sk_psock_skb_ingress_enqueue(), num_sge is zero, and no > page is put to this sge (see sg_set_page in sg_set_page), but this empty > sge is queued into ingress_msg list. > > And in sk_msg_recvmsg(), this empty sge is used, and a NULL page is > got by sg_page(sge). Pass this NULL-page to copy_page_to_iter(), it > passed to kmap_local_page() and page_address(), then kernel panics. > > To solve this, we should prevent empty skb from putting on the queue. So > in sk_psock_verdict_recv(), if the skb->len is zero, drop this skb. > > Fixes: ef5659280eb1 ("bpf, sockmap: Allow skipping sk_skb parser program") > Signed-off-by: Geliang Tang > --- > net/core/skmsg.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/core/skmsg.c b/net/core/skmsg.c > index fd20aae30be2..44952cdd1425 100644 > --- a/net/core/skmsg.c > +++ b/net/core/skmsg.c > @@ -1184,7 +1184,7 @@ static int sk_psock_verdict_recv(struct sock *sk, struct sk_buff *skb) > > rcu_read_lock(); > psock = sk_psock(sk); > - if (unlikely(!psock)) { > + if (unlikely(!psock || !len)) { > len = 0; > tcp_eat_skb(sk, skb); > sock_drop(sk, skb);