From patchwork Mon May 13 14:19:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1098888 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="MIn5gviI"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 452jch4msVz9s4Y for ; Tue, 14 May 2019 00:19:32 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730154AbfEMOTc (ORCPT ); Mon, 13 May 2019 10:19:32 -0400 Received: from mail-it1-f196.google.com ([209.85.166.196]:35312 "EHLO mail-it1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728867AbfEMOTc (ORCPT ); Mon, 13 May 2019 10:19:32 -0400 Received: by mail-it1-f196.google.com with SMTP id u186so20584420ith.0; Mon, 13 May 2019 07:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=5ar/GHBOf+NmAxnd5M+Y72KZr2xiJVin2jhQ9wQRufY=; b=MIn5gviIX98B2+dKu/+kvdsZE0fw0ri2MSNm1BNiqB60ImYsMj4Y97sk6JmWHkRFmu R1X3srjNhYoWL+WCcymbHO3AO02wPsZCKO9pcwELBxzlpmxHfJBlri1rcnP6ipuIkOsO fgGlvGIYQQ/7R4/HOPbvTG+lne8U9nG98cqRByq35hIkZ/rJ6RQMiJ36ZZJadte4cRb2 g3hKnsN2EkgbdAIz9/t/JV9lXCmKZyQSB9ARW6X9Ry+zXXOR1jEYWyfhx94qv+UTpDos Cx5Tl05gURPiORBoF8Gtf+txqdTqXkBPgZzIuulezeX5vpja3Ovbqx9IPJazhBY4KI5i 2u2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=5ar/GHBOf+NmAxnd5M+Y72KZr2xiJVin2jhQ9wQRufY=; b=RZsjdavlvNguciHOrhcBIiSBy/a+tCIC8hVGEr4ascnEndoE4S/MNb3rZki540+ZW/ kawHgQgsDDl/pP986iGyqLiOO/T8NC52PZpXHwB2YP4fWdzt9hSKQewt2Th4/6wzBdit MBhXh0kkdjhbKGZQLFaOBEXozuhqWs6/2KE/eHAI6pi4At0Cm7/dQz73OxsZEDeaYlnV f6wB6jtEfX67Vt8fWb8NmhIRO5v1OlNlBq7+P4ekozmIskQ8LpFv+Hov+E8F8hjWoS19 zFMDccAVv7EGMhmWfIWWt5cBNjUPC29e+uiLj3APRkPy5Bq/m+9epZjrB86IuzpIi7Fs 4hpA== X-Gm-Message-State: APjAAAUc/LIqhJeNSmqueyw1NXwQxXQBZOV/ntVQ5mSS3S2mL4IZDTkY WFqQ7lzZyezHBAmsiN+T9JA= X-Google-Smtp-Source: APXvYqxPASelMTITDuArZo7INFkbT/o+sSHzn0JMcxStPCvM1oEJ8zjczT+Wa3gDH79nZQ0OOyRJlA== X-Received: by 2002:a24:d486:: with SMTP id x128mr15651248itg.80.1557757171337; Mon, 13 May 2019 07:19:31 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id x23sm4546357iob.57.2019.05.13.07.19.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 May 2019 07:19:30 -0700 (PDT) Subject: [bpf PATCH 1/3] bpf: sockmap, only stop/flush strp if it was enabled at some point From: John Fastabend To: jakub.kicinski@netronome.com, ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 13 May 2019 07:19:19 -0700 Message-ID: <155775715979.22311.14369835450992570068.stgit@john-XPS-13-9360> In-Reply-To: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> References: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-Id: netdev.vger.kernel.org If we try to call strp_done on a parser that has never been initialized, because the sockmap user is only using TX side for example we get the following error. [ 883.422081] WARNING: CPU: 1 PID: 208 at kernel/workqueue.c:3030 __flush_work+0x1ca/0x1e0 ... [ 883.422095] Workqueue: events sk_psock_destroy_deferred [ 883.422097] RIP: 0010:__flush_work+0x1ca/0x1e0 This had been wrapped in a 'if (psock->parser.enabled)' logic which was broken because the strp_done() was never actually being called because we do a strp_stop() earlier in the tear down logic will set parser.enabled to false. This could result in a use after free if work was still in the queue and was resolved by the patch here, 1d79895aef18f ("sk_msg: Always cancel strp work before freeing the psock"). However, calling strp_stop(), done by the patch marked in the fixes tag, only is useful if we never initialized a strp parser program and never initialized the strp to start with. Because if we had initialized a stream parser strp_stop() would have been called by sk_psock_drop() earlier in the tear down process. By forcing the strp to stop we get past the WARNING in strp_done that checks the stopped flag but calling cancel_work_sync on work that has never been initialized is also wrong and generates the warning above. To fix check if the parser program exists. If the program exists then the strp work has been initialized and must be sync'd and cancelled before free'ing any structures. If no program exists we never initialized the stream parser in the first place so skip the sync/cancel logic implemented by strp_done. Finally, remove the strp_done its not needed and in the case where we are using the stream parser has already been called. Fixes: e8e3437762ad9 ("bpf: Stop the psock parser before canceling its work") Signed-off-by: John Fastabend --- net/core/skmsg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index cc94d921476c..49d1efa329d7 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -554,8 +554,10 @@ static void sk_psock_destroy_deferred(struct work_struct *gc) struct sk_psock *psock = container_of(gc, struct sk_psock, gc); /* No sk_callback_lock since already detached. */ - strp_stop(&psock->parser.strp); - strp_done(&psock->parser.strp); + + /* Parser has been stopped */ + if (psock->progs.skb_parser) + strp_done(&psock->parser.strp); cancel_work_sync(&psock->work); From patchwork Mon May 13 14:19:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1098890 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="sD60AhmS"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 452jd32V9Hz9s4Y for ; Tue, 14 May 2019 00:19:51 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729679AbfEMOTu (ORCPT ); Mon, 13 May 2019 10:19:50 -0400 Received: from mail-it1-f195.google.com ([209.85.166.195]:51920 "EHLO mail-it1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728867AbfEMOTu (ORCPT ); Mon, 13 May 2019 10:19:50 -0400 Received: by mail-it1-f195.google.com with SMTP id s3so20556399itk.1; Mon, 13 May 2019 07:19:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=mP8S+aTEH0TfrmSoHVNIm1wecVOgLyl9+6N0y5RZVwA=; b=sD60AhmSoRIY0JXnr0SM/7gusABIvZPmhkoRRIeGoch/0+HU4ASxY6RDI8+hzxwK69 3u4AoX3VE8LcaOh+AyOCw10mHCY+9i44k1+eCmDpJRAdsRLFpzkfOB6mF1m6uFBGxf1S 9kDDkDxAxmXSHW5segy2MotM1AsesCpVDqaLneOWG0hwj1I2qcG7AOkp7yDewRhXrVYI suvTo/OXhtaGcSlZyAvKyiFQlcL7tTvS6qVQWwqWhx4tG0K9lABKnc2RIToerBzgFevf WkWxy1crG8Aajt8XweJcDXDbhUguUj0tTRIxEluAhTdtqqPzxR6M+FWuds+m5FI766ND Ihrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=mP8S+aTEH0TfrmSoHVNIm1wecVOgLyl9+6N0y5RZVwA=; b=OOn5NlThGbZM2tb9LbogSebpVaPEAJIfZFnl2/aBD5Jd48D2iSPR6gVlkj2JbpG1ZC 5u5VSvh/dzwmAeY4mbn3yiL3hvf6HHLEdNN/qM+eUMGPdTPsZr+TkTpnopdfJUcBydZ0 GV3j59ofWLFkDzNv3SXfNZMmYJtXoO6E+QjYw1vHdtV6ktnmIsvXVIoTruu7dVPJDRFS M9GY/jGHICG38/nbYaPd98DtjDPGux8aCYZB+WqNBlkb9S6O+rfzaaHVREiIE7hQCQC+ h6vRm+Gxju4+JRr6F0yA8wYGObjie0V8c7m1WryCn0jWRygy3qPggArDb+6DPjZLUk8g NGoQ== X-Gm-Message-State: APjAAAV4lNMLqw0E8t3X3mOb4YBLnV/3MxztEkd4ZdcUg8T9sRg9VIvQ HSVMAkWZF+L+mRXt4Spj5nU= X-Google-Smtp-Source: APXvYqzcIwR2eabWCVAuF+3jNKhdqAJ0aMLvfc3Ai6vcjjGN9GxAvp8TZo3vZUoY7nYL4rMJocYMSQ== X-Received: by 2002:a24:69c3:: with SMTP id e186mr17620837itc.37.1557757189414; Mon, 13 May 2019 07:19:49 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id p16sm4376186ioh.6.2019.05.13.07.19.42 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 May 2019 07:19:48 -0700 (PDT) Subject: [bpf PATCH 2/3] bpf: sockmap remove duplicate queue free From: John Fastabend To: jakub.kicinski@netronome.com, ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 13 May 2019 07:19:37 -0700 Message-ID: <155775717732.22311.13248108248808306711.stgit@john-XPS-13-9360> In-Reply-To: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> References: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-Id: netdev.vger.kernel.org In tcp bpf remove we free the cork list and purge the ingress msg list. However we do this before the ref count reaches zero so it could be possible some other access is in progress. In this case (tcp close and/or tcp_unhash) we happen to also hold the sock lock so no path exists but lets fix it otherwise it is extremely fragile and breaks the reference counting rules. Also we already check the cork list and ingress msg queue and free them once the ref count reaches zero so its wasteful to check twice. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend --- net/ipv4/tcp_bpf.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 1bb7321a256d..4a619c85daed 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -528,8 +528,6 @@ static void tcp_bpf_remove(struct sock *sk, struct sk_psock *psock) { struct sk_psock_link *link; - sk_psock_cork_free(psock); - __sk_psock_purge_ingress_msg(psock); while ((link = sk_psock_link_pop(psock))) { sk_psock_unlink(sk, link); sk_psock_free_link(link); From patchwork Mon May 13 14:19:55 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Fastabend X-Patchwork-Id: 1098892 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: incoming-bpf@patchwork.ozlabs.org Delivered-To: patchwork-incoming-bpf@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=bpf-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="S73SiI9l"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 452jdN1Kr4z9sBb for ; Tue, 14 May 2019 00:20:08 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730184AbfEMOUH (ORCPT ); Mon, 13 May 2019 10:20:07 -0400 Received: from mail-it1-f195.google.com ([209.85.166.195]:40452 "EHLO mail-it1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730152AbfEMOUH (ORCPT ); Mon, 13 May 2019 10:20:07 -0400 Received: by mail-it1-f195.google.com with SMTP id g71so20532540ita.5; Mon, 13 May 2019 07:20:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:from:to:cc:date:message-id:in-reply-to:references :user-agent:mime-version:content-transfer-encoding; bh=sXjcZAGx/RpTcazRtKGemnEzej0TeSnJcmicvFWVu4Q=; b=S73SiI9lAA7RrOb3X/PjH9wnihNO9U1lablWceDVIXOquRMQsGC1bO7y8yg7/PzZ/r VdmsdHlo4fE3IJ2trn63+Lwr6jWGNOR3iEOfetmEEpbaIkPlsFgz4Goj7sCCSNNmR0BD Zk7RMbm/gO1I2WWJM/vWiJP2uDPg9cbFbf9tBa/T/NvMY0xd0PgSVdBSlmrycaYJeapN kHJ41G3pimy0w2hieukhkFp53k+fA4Zh9kxUH8D5rshuGyS6WNembrnK0N1FGDcF8HSM HrGFK0HRayDMCZVvEa2hM0j3Ct9pRzLRhMBZBkQq/RXQvR7VNQc3aKqexDQb4wJA7f+T ppNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=sXjcZAGx/RpTcazRtKGemnEzej0TeSnJcmicvFWVu4Q=; b=lS+k7Io+MFsoy5FINEqYCKbg7cFVKY8vUlgKI5gDo+Gj0gF9tZE8voKriKDjPNy8Oy jOAd0f/dEsng9Q8TMlJsgB+W9rOAKwmHfcRrPADyAZs43h3rwMzQwBJ6hi6nzl7G6rxo SQMvZdEaLLlIbAVdQQP/xBYg8zZAxfMOq0qjbb07cT/VJ+i2YfWA6zpetScPY6x+dSU8 kYx5YfHl/yd88NCLPdS5hBJreol0T/MfGvr3FzTF1wckdDL5WgLHfthc/gzjvijvQQpR WXXJ/MIA26pYinwYkGhGcyCPRg/+WHQtuvHFeElS0dhlSAZ0VUy2hUZC4NVBByrnPBx2 aLMA== X-Gm-Message-State: APjAAAU5FxN8QcgynWRQw8BLSGjlBgueFCoaiHrVR/PPs6pC5dc4rqcm G/msKvW6ftoi4n88LMcjTQA= X-Google-Smtp-Source: APXvYqycSis09rSUOTEEsQy62HmByDrbwJtKdc9PC0Bz+xtKFq2/h+ZwJS7IAOCGlCfyesocY4bJUQ== X-Received: by 2002:a05:660c:552:: with SMTP id w18mr697748itk.26.1557757206905; Mon, 13 May 2019 07:20:06 -0700 (PDT) Received: from [127.0.1.1] ([184.63.162.180]) by smtp.gmail.com with ESMTPSA id i141sm6272314ite.20.2019.05.13.07.20.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 13 May 2019 07:20:06 -0700 (PDT) Subject: [bpf PATCH 3/3] bpf: sockmap fix msg->sg.size account on ingress skb From: John Fastabend To: jakub.kicinski@netronome.com, ast@kernel.org, daniel@iogearbox.net Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, john.fastabend@gmail.com Date: Mon, 13 May 2019 07:19:55 -0700 Message-ID: <155775719541.22311.9144799183119218586.stgit@john-XPS-13-9360> In-Reply-To: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> References: <155775710768.22311.15370233730402405518.stgit@john-XPS-13-9360> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: bpf-owner@vger.kernel.org Precedence: bulk List-Id: netdev.vger.kernel.org When converting a skb to msg->sg we forget to set the size after the latest ktls/tls code conversion. This patch can be reached by doing a redir into ingress path from BPF skb sock recv hook. Then trying to read the size fails. Fix this by setting the size. Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend --- net/core/skmsg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 49d1efa329d7..93bffaad2135 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -411,6 +411,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) sk_mem_charge(sk, skb->len); copied = skb->len; msg->sg.start = 0; + msg->sg.size = copied; msg->sg.end = num_sge == MAX_MSG_FRAGS ? 0 : num_sge; msg->skb = skb;