[PATCH bpf-next] bpf: clear the ip_tunnel_info.

[PATCH bpf-next] bpf: clear the ip_tunnel_info.

[William Tu]

The percpu metadata_dst might carry the stale ip_tunnel_info
and cause incorrect behavior.  When mixing tests using ipv4/ipv6
bpf vxlan and geneve tunnel, the ipv6 tunnel info incorrectly uses
ipv4's src ip addr as its ipv6 src address, because the previous
tunnel info does not clean up.  The patch zeros the fields in
ip_tunnel_info.

Signed-off-by: William Tu <u9012063@gmail.com>
Reported-by: Yifeng Sun <pkusunyifeng@gmail.com>
---
 net/core/filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/core/filter.c b/net/core/filter.c
index 8e45c6c7ab08..d3781daa26ab 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3281,6 +3281,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
 	skb_dst_set(skb, (struct dst_entry *) md);
 
 	info = &md->u.tun_info;
+	memset(info, 0, sizeof(*info));
 	info->mode = IP_TUNNEL_INFO_TX;
 
 	info->key.tun_flags = TUNNEL_KEY | TUNNEL_CSUM | TUNNEL_NOCACHE;
-- 
2.7.4

Re: [PATCH bpf-next] bpf: clear the ip_tunnel_info.

[Daniel Borkmann]

On 04/25/2018 08:46 AM, William Tu wrote:
> The percpu metadata_dst might carry the stale ip_tunnel_info
> and cause incorrect behavior.  When mixing tests using ipv4/ipv6
> bpf vxlan and geneve tunnel, the ipv6 tunnel info incorrectly uses
> ipv4's src ip addr as its ipv6 src address, because the previous
> tunnel info does not clean up.  The patch zeros the fields in
> ip_tunnel_info.
> 
> Signed-off-by: William Tu <u9012063@gmail.com>
> Reported-by: Yifeng Sun <pkusunyifeng@gmail.com>

Since this is a fix, I've applied this to bpf, thanks William!

Re: [PATCH bpf-next] bpf: clear the ip_tunnel_info.

[William Tu]

On Wed, Apr 25, 2018 at 12:54 AM, Daniel Borkmann <daniel@iogearbox.net> wrote:
> On 04/25/2018 08:46 AM, William Tu wrote:
>> The percpu metadata_dst might carry the stale ip_tunnel_info
>> and cause incorrect behavior.  When mixing tests using ipv4/ipv6
>> bpf vxlan and geneve tunnel, the ipv6 tunnel info incorrectly uses
>> ipv4's src ip addr as its ipv6 src address, because the previous
>> tunnel info does not clean up.  The patch zeros the fields in
>> ip_tunnel_info.
>>
>> Signed-off-by: William Tu <u9012063@gmail.com>
>> Reported-by: Yifeng Sun <pkusunyifeng@gmail.com>
>
> Since this is a fix, I've applied this to bpf, thanks William!

Thanks.
Just to add some context about this issue.
This happens when doing in sequence
1) start ipv4 vxlan bpf tunnel
2) delete all related devices
3) start ipv6 vxlan bpf tunnel

The first ipv4 vxlan tunnel sets the ipv4 src ip in the ip_tunnel_key
and does not clear. So the 3) ipv6 vxlan bpf tunnel, uses the ipv4's
address as its ipv6 address.  As a result, vxlan driver reports
[81227.576732] ip6vxlan00: add 7a:2c:d7:fe:a9:43 ->
0000:0000:ac10:0164:0000:0000:0000:0000
[81237.614330] ip6vxlan00: no route to 0000:0000:ac10:0164:0000:0000:0000:0000
where "ac10:0164" is 172.16.1.200.

Similar issue when testing ipv4 geneve followed by ipv6 geneve.
Regards,
William