From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49091C169C4 for ; Tue, 29 Jan 2019 22:50:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1FDD12147A for ; Tue, 29 Jan 2019 22:50:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729753AbfA2Wuz (ORCPT ); Tue, 29 Jan 2019 17:50:55 -0500 Received: from mx1.redhat.com ([209.132.183.28]:33036 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729650AbfA2Wuy (ORCPT ); Tue, 29 Jan 2019 17:50:54 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 244391F58E; Tue, 29 Jan 2019 22:50:54 +0000 (UTC) Received: from redhat.com (ovpn-123-79.rdu2.redhat.com [10.10.123.79]) by smtp.corp.redhat.com (Postfix) with SMTP id 855975D6A6; Tue, 29 Jan 2019 22:50:50 +0000 (UTC) Date: Tue, 29 Jan 2019 17:50:49 -0500 From: "Michael S. Tsirkin" To: Toshiaki Makita Cc: "David S. Miller" , Jason Wang , netdev@vger.kernel.org, virtualization@lists.linux-foundation.org, Jesper Dangaard Brouer Subject: Re: [PATCH v2 net 5/7] virtio_net: Don't process redirected XDP frames when XDP is disabled Message-ID: <20190129175044-mutt-send-email-mst@kernel.org> References: <1548722759-2470-1-git-send-email-makita.toshiaki@lab.ntt.co.jp> <1548722759-2470-6-git-send-email-makita.toshiaki@lab.ntt.co.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1548722759-2470-6-git-send-email-makita.toshiaki@lab.ntt.co.jp> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 29 Jan 2019 22:50:54 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Tue, Jan 29, 2019 at 09:45:57AM +0900, Toshiaki Makita wrote: > Commit 8dcc5b0ab0ec ("virtio_net: fix ndo_xdp_xmit crash towards dev not > ready for XDP") tried to avoid access to unexpected sq while XDP is > disabled, but was not complete. > > There was a small window which causes out of bounds sq access in > virtnet_xdp_xmit() while disabling XDP. > > An example case of > - curr_queue_pairs = 6 (2 for SKB and 4 for XDP) > - online_cpu_num = xdp_queue_paris = 4 > when XDP is enabled: > > CPU 0 CPU 1 > (Disabling XDP) (Processing redirected XDP frames) > > virtnet_xdp_xmit() > virtnet_xdp_set() > _virtnet_set_queues() > set curr_queue_pairs (2) > check if rq->xdp_prog is not NULL > virtnet_xdp_sq(vi) > qp = curr_queue_pairs - > xdp_queue_pairs + > smp_processor_id() > = 2 - 4 + 1 = -1 > sq = &vi->sq[qp] // out of bounds access > set xdp_queue_pairs (0) > rq->xdp_prog = NULL > > Basically we should not change curr_queue_pairs and xdp_queue_pairs > while someone can read the values. Thus, when disabling XDP, assign NULL > to rq->xdp_prog first, and wait for RCU grace period, then change > xxx_queue_pairs. > Note that we need to keep the current order when enabling XDP though. > > - v2: Make rcu_assign_pointer/synchronize_net conditional instead of > _virtnet_set_queues. > > Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT") > Signed-off-by: Toshiaki Makita Acked-by: Michael S. Tsirkin > --- > drivers/net/virtio_net.c | 33 ++++++++++++++++++++++++++------- > 1 file changed, 26 insertions(+), 7 deletions(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 669b65c..cea52e4 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -2410,6 +2410,10 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, > return -ENOMEM; > } > > + old_prog = rtnl_dereference(vi->rq[0].xdp_prog); > + if (!prog && !old_prog) > + return 0; > + > if (prog) { > prog = bpf_prog_add(prog, vi->max_queue_pairs - 1); > if (IS_ERR(prog)) > @@ -2424,21 +2428,30 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, > } > } > > + if (!prog) { > + for (i = 0; i < vi->max_queue_pairs; i++) { > + rcu_assign_pointer(vi->rq[i].xdp_prog, prog); > + if (i == 0) > + virtnet_restore_guest_offloads(vi); > + } > + synchronize_net(); > + } > + > err = _virtnet_set_queues(vi, curr_qp + xdp_qp); > if (err) > goto err; > netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp); > vi->xdp_queue_pairs = xdp_qp; > > - for (i = 0; i < vi->max_queue_pairs; i++) { > - old_prog = rtnl_dereference(vi->rq[i].xdp_prog); > - rcu_assign_pointer(vi->rq[i].xdp_prog, prog); > - if (i == 0) { > - if (!old_prog) > + if (prog) { > + for (i = 0; i < vi->max_queue_pairs; i++) { > + rcu_assign_pointer(vi->rq[i].xdp_prog, prog); > + if (i == 0 && !old_prog) > virtnet_clear_guest_offloads(vi); > - if (!prog) > - virtnet_restore_guest_offloads(vi); > } > + } > + > + for (i = 0; i < vi->max_queue_pairs; i++) { > if (old_prog) > bpf_prog_put(old_prog); > if (netif_running(dev)) { > @@ -2451,6 +2464,12 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, > return 0; > > err: > + if (!prog) { > + virtnet_clear_guest_offloads(vi); > + for (i = 0; i < vi->max_queue_pairs; i++) > + rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog); > + } > + > if (netif_running(dev)) { > for (i = 0; i < vi->max_queue_pairs; i++) { > virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi); > -- > 1.8.3.1 >