* [PATCH bpf 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
2022-11-16 11:29 [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
@ 2022-11-16 11:29 ` Pengcheng Yang
2022-11-16 11:29 ` [PATCH bpf 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes Pengcheng Yang
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-16 11:29 UTC (permalink / raw)
To: John Fastabend, Jakub Sitnicki, bpf, netdev; +Cc: Pengcheng Yang
When redirecting, we use sk_msg_to_ingress() to get the BPF_F_INGRESS
flag from the msg->flags. If apply_bytes is used and it is larger than
the current data being processed, sk_psock_msg_verdict() will not be
called when sendmsg() is called again. At this time, the msg->flags is 0,
and we lost the BPF_F_INGRESS flag.
So we need to save the BPF_F_INGRESS flag in sk_psock and assign it to
msg->flags before redirection.
Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
include/linux/skmsg.h | 1 +
net/core/skmsg.c | 1 +
net/ipv4/tcp_bpf.c | 1 +
net/tls/tls_sw.c | 1 +
4 files changed, 4 insertions(+)
diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index 48f4b64..e1d463f 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -82,6 +82,7 @@ struct sk_psock {
u32 apply_bytes;
u32 cork_bytes;
u32 eval;
+ u32 flags;
struct sk_msg *cork;
struct sk_psock_progs progs;
#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 188f855..ab2f8f3 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -888,6 +888,7 @@ int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
if (psock->sk_redir)
sock_put(psock->sk_redir);
psock->sk_redir = msg->sk_redir;
+ psock->flags = msg->flags;
if (!psock->sk_redir) {
ret = __SK_DROP;
goto out;
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index ef5de4f..1390d72 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -323,6 +323,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
break;
case __SK_REDIRECT:
sk_redir = psock->sk_redir;
+ msg->flags = psock->flags;
sk_msg_apply_bytes(psock, tosend);
if (!psock->apply_bytes) {
/* Clean up before releasing the sock lock. */
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index fe27241..49e424d 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -838,6 +838,7 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
break;
case __SK_REDIRECT:
sk_redir = psock->sk_redir;
+ msg->flags = psock->flags;
memcpy(&msg_redir, msg, sizeof(*msg));
if (msg->apply_bytes < send)
msg->apply_bytes = 0;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH bpf 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes
2022-11-16 11:29 [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
2022-11-16 11:29 ` [PATCH bpf 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when " Pengcheng Yang
@ 2022-11-16 11:29 ` Pengcheng Yang
2022-11-21 9:35 ` [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Jakub Sitnicki
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-16 11:29 UTC (permalink / raw)
To: John Fastabend, Jakub Sitnicki, bpf, netdev; +Cc: Pengcheng Yang
Currently, the ingress redirect is not covered in "txmsg test apply".
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
tools/testing/selftests/bpf/test_sockmap.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 0fbaccd..9bc0cb4 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -1649,24 +1649,42 @@ static void test_txmsg_apply(int cgrp, struct sockmap_options *opt)
{
txmsg_pass = 1;
txmsg_redir = 0;
+ txmsg_ingress = 0;
txmsg_apply = 1;
txmsg_cork = 0;
test_send_one(opt, cgrp);
txmsg_pass = 0;
txmsg_redir = 1;
+ txmsg_ingress = 0;
+ txmsg_apply = 1;
+ txmsg_cork = 0;
+ test_send_one(opt, cgrp);
+
+ txmsg_pass = 0;
+ txmsg_redir = 1;
+ txmsg_ingress = 1;
txmsg_apply = 1;
txmsg_cork = 0;
test_send_one(opt, cgrp);
txmsg_pass = 1;
txmsg_redir = 0;
+ txmsg_ingress = 0;
+ txmsg_apply = 1024;
+ txmsg_cork = 0;
+ test_send_large(opt, cgrp);
+
+ txmsg_pass = 0;
+ txmsg_redir = 1;
+ txmsg_ingress = 0;
txmsg_apply = 1024;
txmsg_cork = 0;
test_send_large(opt, cgrp);
txmsg_pass = 0;
txmsg_redir = 1;
+ txmsg_ingress = 1;
txmsg_apply = 1024;
txmsg_cork = 0;
test_send_large(opt, cgrp);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes
2022-11-16 11:29 [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
2022-11-16 11:29 ` [PATCH bpf 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when " Pengcheng Yang
2022-11-16 11:29 ` [PATCH bpf 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes Pengcheng Yang
@ 2022-11-21 9:35 ` Jakub Sitnicki
2022-11-21 16:38 ` Daniel Borkmann
[not found] ` <1668598161-15455-2-git-send-email-yangpc@wangsu.com>
4 siblings, 0 replies; 6+ messages in thread
From: Jakub Sitnicki @ 2022-11-21 9:35 UTC (permalink / raw)
To: Pengcheng Yang; +Cc: John Fastabend, bpf, netdev
On Wed, Nov 16, 2022 at 07:29 PM +08, Pengcheng Yang wrote:
> Patch 0001~0003 fixes three issues with using apply_bytes when redirecting.
> Patch 0004 adds ingress tests for txmsg with apply_bytes in selftests.
>
> Pengcheng Yang (4):
> bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
> bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
> bpf, sockmap: Fix data loss caused by using apply_bytes on ingress
> redirect
> selftests/bpf: Add ingress tests for txmsg with apply_bytes
>
> include/linux/skmsg.h | 1 +
> net/core/skmsg.c | 1 +
> net/ipv4/tcp_bpf.c | 9 +++++++--
> net/tls/tls_sw.c | 1 +
> tools/testing/selftests/bpf/test_sockmap.c | 18 ++++++++++++++++++
> 5 files changed, 28 insertions(+), 2 deletions(-)
Thanks for the patches. I need a bit more time to review them.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes
2022-11-16 11:29 [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
` (2 preceding siblings ...)
2022-11-21 9:35 ` [PATCH bpf 0/4] bpf, sockmap: Fix some issues with using apply_bytes Jakub Sitnicki
@ 2022-11-21 16:38 ` Daniel Borkmann
[not found] ` <1668598161-15455-2-git-send-email-yangpc@wangsu.com>
4 siblings, 0 replies; 6+ messages in thread
From: Daniel Borkmann @ 2022-11-21 16:38 UTC (permalink / raw)
To: Pengcheng Yang, John Fastabend, Jakub Sitnicki, bpf, netdev
On 11/16/22 12:29 PM, Pengcheng Yang wrote:
> Patch 0001~0003 fixes three issues with using apply_bytes when redirecting.
> Patch 0004 adds ingress tests for txmsg with apply_bytes in selftests.
>
> Pengcheng Yang (4):
> bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
> bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
> bpf, sockmap: Fix data loss caused by using apply_bytes on ingress
> redirect
> selftests/bpf: Add ingress tests for txmsg with apply_bytes
Patch 1 & 3 didn't make it to the list [0], could you resend your series?
[0] https://lore.kernel.org/bpf/1668598161-15455-1-git-send-email-yangpc@wangsu.com/
> include/linux/skmsg.h | 1 +
> net/core/skmsg.c | 1 +
> net/ipv4/tcp_bpf.c | 9 +++++++--
> net/tls/tls_sw.c | 1 +
> tools/testing/selftests/bpf/test_sockmap.c | 18 ++++++++++++++++++
> 5 files changed, 28 insertions(+), 2 deletions(-)
>
^ permalink raw reply [flat|nested] 6+ messages in thread[parent not found: <1668598161-15455-2-git-send-email-yangpc@wangsu.com>]
* RE: [PATCH bpf 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
[not found] ` <1668598161-15455-2-git-send-email-yangpc@wangsu.com>
@ 2022-11-22 2:16 ` John Fastabend
0 siblings, 0 replies; 6+ messages in thread
From: John Fastabend @ 2022-11-22 2:16 UTC (permalink / raw)
To: Pengcheng Yang, John Fastabend, Jakub Sitnicki, bpf, netdev
Cc: Pengcheng Yang
Pengcheng Yang wrote:
> In tcp_bpf_send_verdict() redirection, the eval variable is assigned to
> __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data,
> sock_put() will be called multiple times.
> We should reset the eval variable to __SK_NONE every time more_data
> starts.
>
> This causes:
>
> IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7
> ------------[ cut here ]------------
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110
> Modules linked in:
> CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1
> Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014
> Call Trace:
> <TASK>
> __tcp_transmit_skb+0xa1b/0xb90
> ? __alloc_skb+0x8c/0x1a0
> ? __kmalloc_node_track_caller+0x184/0x320
> tcp_write_xmit+0x22a/0x1110
> __tcp_push_pending_frames+0x32/0xf0
> do_tcp_sendpages+0x62d/0x640
> tcp_bpf_push+0xae/0x2c0
> tcp_bpf_sendmsg_redir+0x260/0x410
> ? preempt_count_add+0x70/0xa0
> tcp_bpf_send_verdict+0x386/0x4b0
> tcp_bpf_sendmsg+0x21b/0x3b0
> sock_sendmsg+0x58/0x70
> __sys_sendto+0xfa/0x170
> ? xfd_validate_state+0x1d/0x80
> ? switch_fpu_return+0x59/0xe0
> __x64_sys_sendto+0x24/0x30
> do_syscall_64+0x37/0x90
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Fixes: cd9733f5d75c ("tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function")
> Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
I'll wait for the resend with all the patches but for this one.
Acked-by: John Fastabend <john.fastabend@gmail.com>
^ permalink raw reply [flat|nested] 6+ messages in thread