From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [bpf PATCH 3/3] bpf: sockmap, fix error handling in redirect failures Date: Wed, 02 May 2018 14:51:52 -0400 (EDT) Message-ID: <20180502.145152.30281601337299502.davem@davemloft.net> References: <20180502173954.17875.19624.stgit@john-Precision-Tower-5810> <20180502174737.17875.74031.stgit@john-Precision-Tower-5810> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: borkmann@iogearbox.net, ast@kernel.org, netdev@vger.kernel.org To: john.fastabend@gmail.com Return-path: Received: from shards.monkeyblade.net ([184.105.139.130]:36136 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751087AbeEBSvx (ORCPT ); Wed, 2 May 2018 14:51:53 -0400 In-Reply-To: <20180502174737.17875.74031.stgit@john-Precision-Tower-5810> Sender: netdev-owner@vger.kernel.org List-ID: From: John Fastabend Date: Wed, 02 May 2018 10:47:37 -0700 > When a redirect failure happens we release the buffers in-flight > without calling a sk_mem_uncharge(), the uncharge is called before > dropping the sock lock for the redirecte, however we missed updating > the ring start index. When no apply actions are in progress this > is OK because we uncharge the entire buffer before the redirect. > But, when we have apply logic running its possible that only a > portion of the buffer is being redirected. In this case we only > do memory accounting for the buffer slice being redirected and > expect to be able to loop over the BPF program again and/or if > a sock is closed uncharge the memory at sock destruct time. > > With an invalid start index however the program logic looks at > the start pointer index, checks the length, and when seeing the > length is zero (from the initial release and failure to update > the pointer) aborts without uncharging/releasing the remaining > memory. > > The fix for this is simply to update the start index. To avoid > fixing this error in two locations we do a small refactor and > remove one case where it is open-coded. Then fix it in the > single function. > > Signed-off-by: John Fastabend Acked-by: David S. Miller