* [PATCH bpf v2 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
2022-11-28 11:24 [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
@ 2022-11-28 11:24 ` Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes Pengcheng Yang
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-28 11:24 UTC (permalink / raw)
To: bpf, netdev, John Fastabend, Daniel Borkmann, Jakub Sitnicki,
Lorenz Bauer
Cc: Pengcheng Yang
In tcp_bpf_send_verdict() redirection, the eval variable is assigned to
__SK_REDIRECT after the apply_bytes data is sent, if msg has more_data,
sock_put() will be called multiple times.
We should reset the eval variable to __SK_NONE every time more_data
starts.
This causes:
IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110
Modules linked in:
CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1
Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014
Call Trace:
<TASK>
__tcp_transmit_skb+0xa1b/0xb90
? __alloc_skb+0x8c/0x1a0
? __kmalloc_node_track_caller+0x184/0x320
tcp_write_xmit+0x22a/0x1110
__tcp_push_pending_frames+0x32/0xf0
do_tcp_sendpages+0x62d/0x640
tcp_bpf_push+0xae/0x2c0
tcp_bpf_sendmsg_redir+0x260/0x410
? preempt_count_add+0x70/0xa0
tcp_bpf_send_verdict+0x386/0x4b0
tcp_bpf_sendmsg+0x21b/0x3b0
sock_sendmsg+0x58/0x70
__sys_sendto+0xfa/0x170
? xfd_validate_state+0x1d/0x80
? switch_fpu_return+0x59/0xe0
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x37/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Fixes: cd9733f5d75c ("tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
net/ipv4/tcp_bpf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index f8b12b9..ef5de4f 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -279,7 +279,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
bool cork = false, enospc = sk_msg_full(msg);
struct sock *sk_redir;
u32 tosend, origsize, sent, delta = 0;
- u32 eval = __SK_NONE;
+ u32 eval;
int ret;
more_data:
@@ -310,6 +310,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
tosend = msg->sg.size;
if (psock->apply_bytes && psock->apply_bytes < tosend)
tosend = psock->apply_bytes;
+ eval = __SK_NONE;
switch (psock->eval) {
case __SK_PASS:
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH bpf v2 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes
2022-11-28 11:24 [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data Pengcheng Yang
@ 2022-11-28 11:24 ` Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 3/4] bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect Pengcheng Yang
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-28 11:24 UTC (permalink / raw)
To: bpf, netdev, John Fastabend, Daniel Borkmann, Jakub Sitnicki,
Lorenz Bauer
Cc: Pengcheng Yang
When redirecting, we use sk_msg_to_ingress() to get the BPF_F_INGRESS
flag from the msg->flags. If apply_bytes is used and it is larger than
the current data being processed, sk_psock_msg_verdict() will not be
called when sendmsg() is called again. At this time, the msg->flags is 0,
and we lost the BPF_F_INGRESS flag.
So we need to save the BPF_F_INGRESS flag in sk_psock and assign it to
msg->flags before redirection.
Fixes: 8934ce2fd081 ("bpf: sockmap redirect ingress support")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
include/linux/skmsg.h | 1 +
net/core/skmsg.c | 1 +
net/ipv4/tcp_bpf.c | 2 ++
net/tls/tls_sw.c | 1 +
4 files changed, 5 insertions(+)
diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h
index 48f4b64..e1d463f 100644
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -82,6 +82,7 @@ struct sk_psock {
u32 apply_bytes;
u32 cork_bytes;
u32 eval;
+ u32 flags;
struct sk_msg *cork;
struct sk_psock_progs progs;
#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 188f855..ab2f8f3 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -888,6 +888,7 @@ int sk_psock_msg_verdict(struct sock *sk, struct sk_psock *psock,
if (psock->sk_redir)
sock_put(psock->sk_redir);
psock->sk_redir = msg->sk_redir;
+ psock->flags = msg->flags;
if (!psock->sk_redir) {
ret = __SK_DROP;
goto out;
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index ef5de4f..ac883c9 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -323,12 +323,14 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
break;
case __SK_REDIRECT:
sk_redir = psock->sk_redir;
+ msg->flags = psock->flags;
sk_msg_apply_bytes(psock, tosend);
if (!psock->apply_bytes) {
/* Clean up before releasing the sock lock. */
eval = psock->eval;
psock->eval = __SK_NONE;
psock->sk_redir = NULL;
+ psock->flags = 0;
}
if (psock->cork) {
cork = true;
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index fe27241..49e424d 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -838,6 +838,7 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
break;
case __SK_REDIRECT:
sk_redir = psock->sk_redir;
+ msg->flags = psock->flags;
memcpy(&msg_redir, msg, sizeof(*msg));
if (msg->apply_bytes < send)
msg->apply_bytes = 0;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH bpf v2 3/4] bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
2022-11-28 11:24 [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 1/4] bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 2/4] bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes Pengcheng Yang
@ 2022-11-28 11:24 ` Pengcheng Yang
2022-11-28 11:24 ` [PATCH bpf v2 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes Pengcheng Yang
2022-11-28 18:14 ` [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes John Fastabend
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-28 11:24 UTC (permalink / raw)
To: bpf, netdev, John Fastabend, Daniel Borkmann, Jakub Sitnicki,
Lorenz Bauer
Cc: Pengcheng Yang
Use apply_bytes on ingress redirect, when apply_bytes is less than
the length of msg data, some data may be skipped and lost in
bpf_tcp_ingress().
If there is still data in the scatterlist that has not been consumed,
we cannot move the msg iter.
Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
net/ipv4/tcp_bpf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index ac883c9..722a8c0 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -45,8 +45,11 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
tmp->sg.end = i;
if (apply) {
apply_bytes -= size;
- if (!apply_bytes)
+ if (!apply_bytes) {
+ if (sge->length)
+ sk_msg_iter_var_prev(i);
break;
+ }
}
} while (i != msg->sg.end);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH bpf v2 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes
2022-11-28 11:24 [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
` (2 preceding siblings ...)
2022-11-28 11:24 ` [PATCH bpf v2 3/4] bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect Pengcheng Yang
@ 2022-11-28 11:24 ` Pengcheng Yang
2022-11-28 18:14 ` [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes John Fastabend
4 siblings, 0 replies; 6+ messages in thread
From: Pengcheng Yang @ 2022-11-28 11:24 UTC (permalink / raw)
To: bpf, netdev, John Fastabend, Daniel Borkmann, Jakub Sitnicki,
Lorenz Bauer
Cc: Pengcheng Yang
Currently, the ingress redirect is not covered in "txmsg test apply".
Signed-off-by: Pengcheng Yang <yangpc@wangsu.com>
---
tools/testing/selftests/bpf/test_sockmap.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/tools/testing/selftests/bpf/test_sockmap.c b/tools/testing/selftests/bpf/test_sockmap.c
index 0fbaccd..9bc0cb4 100644
--- a/tools/testing/selftests/bpf/test_sockmap.c
+++ b/tools/testing/selftests/bpf/test_sockmap.c
@@ -1649,24 +1649,42 @@ static void test_txmsg_apply(int cgrp, struct sockmap_options *opt)
{
txmsg_pass = 1;
txmsg_redir = 0;
+ txmsg_ingress = 0;
txmsg_apply = 1;
txmsg_cork = 0;
test_send_one(opt, cgrp);
txmsg_pass = 0;
txmsg_redir = 1;
+ txmsg_ingress = 0;
+ txmsg_apply = 1;
+ txmsg_cork = 0;
+ test_send_one(opt, cgrp);
+
+ txmsg_pass = 0;
+ txmsg_redir = 1;
+ txmsg_ingress = 1;
txmsg_apply = 1;
txmsg_cork = 0;
test_send_one(opt, cgrp);
txmsg_pass = 1;
txmsg_redir = 0;
+ txmsg_ingress = 0;
+ txmsg_apply = 1024;
+ txmsg_cork = 0;
+ test_send_large(opt, cgrp);
+
+ txmsg_pass = 0;
+ txmsg_redir = 1;
+ txmsg_ingress = 0;
txmsg_apply = 1024;
txmsg_cork = 0;
test_send_large(opt, cgrp);
txmsg_pass = 0;
txmsg_redir = 1;
+ txmsg_ingress = 1;
txmsg_apply = 1024;
txmsg_cork = 0;
test_send_large(opt, cgrp);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* RE: [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes
2022-11-28 11:24 [PATCH bpf v2 0/4] bpf, sockmap: Fix some issues with using apply_bytes Pengcheng Yang
` (3 preceding siblings ...)
2022-11-28 11:24 ` [PATCH bpf v2 4/4] selftests/bpf: Add ingress tests for txmsg with apply_bytes Pengcheng Yang
@ 2022-11-28 18:14 ` John Fastabend
4 siblings, 0 replies; 6+ messages in thread
From: John Fastabend @ 2022-11-28 18:14 UTC (permalink / raw)
To: Pengcheng Yang, bpf, netdev, John Fastabend, Daniel Borkmann,
Jakub Sitnicki, Lorenz Bauer
Cc: Pengcheng Yang
Pengcheng Yang wrote:
> Patch 1~3 fixes three issues with using apply_bytes when redirecting.
> Patch 4 adds ingress tests for txmsg with apply_bytes in selftests.
>
> ---
> Changes in v2:
> *Patch 2: Clear psock->flags explicitly before releasing the sock lock
Yeah I think its slightly nicer Thanks for fixing this.
For the series.
Acked-by: John Fastabend <john.fastabend@gmail.com>
^ permalink raw reply [flat|nested] 6+ messages in thread