[PATCH bpf 0/3] Couple of sockmap fixes

[PATCH bpf 0/3] Couple of sockmap fixes

[Daniel Borkmann]

Two sockmap fixes in bpf_tcp_sendmsg(), and one fix for the
sockmap kernel selftest. Thanks!

Daniel Borkmann (3):
  bpf, sockmap: fix bpf_tcp_sendmsg sock error handling
  bpf, sockmap: fix leak in bpf_tcp_sendmsg wait for mem path
  bpf, sockmap: fix cork timeout for select due to epipe

 kernel/bpf/sockmap.c                       | 9 ++++++---
 tools/testing/selftests/bpf/test_sockmap.c | 2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

-- 
2.9.5

[PATCH bpf 1/3] bpf, sockmap: fix bpf_tcp_sendmsg sock error handling

[Daniel Borkmann]

While working on bpf_tcp_sendmsg() code, I noticed that when a
sk->sk_err is set we error out with err = sk->sk_err. However
this is problematic since sk->sk_err is a positive error value
and therefore we will neither go into sk_stream_error() nor will
we report an error back to user space. I had this case with EPIPE
and user space was thinking sendmsg() succeeded since EPIPE is
a positive value, thinking we submitted 32 bytes. Fix it by
negating the sk->sk_err value.

Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
---
 kernel/bpf/sockmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index 98fb793..f7360c4 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1053,7 +1053,7 @@ static int bpf_tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 		int copy;
 
 		if (sk->sk_err) {
-			err = sk->sk_err;
+			err = -sk->sk_err;
 			goto out_err;
 		}
 
-- 
2.9.5

[PATCH bpf 2/3] bpf, sockmap: fix leak in bpf_tcp_sendmsg wait for mem path

[Daniel Borkmann]

In bpf_tcp_sendmsg() the sk_alloc_sg() may fail. In the case of
ENOMEM, it may also mean that we've partially filled the scatterlist
entries with pages. Later jumping to sk_stream_wait_memory()
we could further fail with an error for several reasons, however
we miss to call free_start_sg() if the local sk_msg_buff was used.

Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
---
 kernel/bpf/sockmap.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index f7360c4..c4d75c5 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -1048,7 +1048,7 @@ static int bpf_tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
 
 	while (msg_data_left(msg)) {
-		struct sk_msg_buff *m;
+		struct sk_msg_buff *m = NULL;
 		bool enospc = false;
 		int copy;
 
@@ -1116,8 +1116,11 @@ static int bpf_tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
 		err = sk_stream_wait_memory(sk, &timeo);
-		if (err)
+		if (err) {
+			if (m && m != psock->cork)
+				free_start_sg(sk, m);
 			goto out_err;
+		}
 	}
 out_err:
 	if (err < 0)
-- 
2.9.5

[PATCH bpf 3/3] bpf, sockmap: fix cork timeout for select due to epipe

[Daniel Borkmann]

I ran into the same issue as a009f1f396d0 ("selftests/bpf:
test_sockmap, timing improvements") where I had a broken
pipe error on the socket due to remote end timing out on
select and then shutting down it's sockets while the other
side was still sending. We may need to do a bigger rework
in general on the test_sockmap.c, but for now increase it
to a more suitable timeout.

Fixes: a18fda1a62c3 ("bpf: reduce runtime of test_sockmap tests")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
---
 tools/testing/selftests/bpf/test_sockmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 9e78df2..0c7d9e5 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -354,7 +354,7 @@ static int msg_loop(int fd, int iov_count, int iov_length, int cnt,
 		while (s->bytes_recvd < total_bytes) {
 			if (txmsg_cork) {
 				timeout.tv_sec = 0;
-				timeout.tv_usec = 1000;
+				timeout.tv_usec = 300000;
 			} else {
 				timeout.tv_sec = 1;
 				timeout.tv_usec = 0;
-- 
2.9.5

Re: [PATCH bpf 0/3] Couple of sockmap fixes

[Alexei Starovoitov]

On Wed, Aug 08, 2018 at 07:23:12PM +0200, Daniel Borkmann wrote:
> Two sockmap fixes in bpf_tcp_sendmsg(), and one fix for the
> sockmap kernel selftest. Thanks!

test_sockmap jumped from 10 to 47 seconds :(
but applied anyway.
Thanks

[PATCH bpf 0/3] Couple of sockmap fixes

[Daniel Borkmann]

On 08/08/2018 09:13 PM, Alexei Starovoitov wrote:
> On Wed, Aug 08, 2018 at 07:23:12PM +0200, Daniel Borkmann wrote:
>> Two sockmap fixes in bpf_tcp_sendmsg(), and one fix for the
>> sockmap kernel selftest. Thanks!
> 
> test_sockmap jumped from 10 to 47 seconds :(

Agree, it's unfortunate, but otherwise the tests keep failing since the fix
in patch 1 does propagate errors now. So while test_sockmap before that fix
was succeeding for me, it correctly exposed the EPIPE now due to the timeout,
so it's a minimal workaround (for the time being).

> but applied anyway.
> Thanks

Thanks!