[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230706153327.99298-1-kuniyu@amazon.com>
Date: Thu, 6 Jul 2023 08:33:27 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <lmb@...valent.com>
CC: <andrii@...nel.org>, <ast@...nel.org>, <bpf@...r.kernel.org>,
<daniel@...earbox.net>, <davem@...emloft.net>,
<dsahern@...nel.org>, <edumazet@...gle.com>, <haoluo@...gle.com>,
<hemanthmalla@...il.com>, <joe@...ium.io>, <joe@...d.net.nz>,
<john.fastabend@...il.com>, <jolsa@...nel.org>,
<kpsingh@...nel.org>, <kuba@...nel.org>, <kuniyu@...zon.com>,
<linux-kernel@...r.kernel.org>, <linux-kselftest@...r.kernel.org>,
<martin.lau@...ux.dev>, <mykolal@...com>, <netdev@...r.kernel.org>,
<pabeni@...hat.com>, <sdf@...gle.com>, <shuah@...nel.org>,
<song@...nel.org>, <willemdebruijn.kernel@...il.com>, <yhs@...com>
Subject: Re: [PATCH bpf-next v4 6/7] bpf, net: Support SO_REUSEPORT sockets with bpf_sk_assign
From: Lorenz Bauer <lmb@...valent.com>
Date: Thu, 6 Jul 2023 09:11:15 +0100
> On Thu, Jul 6, 2023 at 1:41 AM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
> >
> > Sorry for late reply.
> >
> > What we know about sk before inet6?_lookup_reuseport() are
> >
> > (1) sk was full socket in bpf_sk_assign()
> > (2) sk had SOCK_RCU_FREE in bpf_sk_assign()
> > (3) sk was TCP_LISTEN here if TCP
>
> Are we looking at the same bpf_sk_assign? Confusingly there are two
> very similarly named functions. The one we care about is:
>
> BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags)
> {
> if (!sk || flags != 0)
> return -EINVAL;
> if (!skb_at_tc_ingress(skb))
> return -EOPNOTSUPP;
> if (unlikely(dev_net(skb->dev) != sock_net(sk)))
> return -ENETUNREACH;
> if (sk_is_refcounted(sk) &&
> unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
> return -ENOENT;
>
> skb_orphan(skb);
> skb->sk = sk;
> skb->destructor = sock_pfree;
>
> return 0;
> }
>
> From this we can't tell what state the socket is in or whether it is
> RCU freed or not.
But we can in inet6?_steal_sock() by calling sk_is_refcounted() again
via skb_steal_sock().
In inet6?_steal_sock(), we call inet6?_lookup_reuseport() only for
sk that was a TCP listener or UDP non-connected socket until just before
the sk_state checks. Then, we know *refcounted should be false for such
sockets even before inet6?_lookup_reuseport().
After the checks, sk might be poped out of the reuseport group before
inet6?_lookup_reuseport() and reuse_sk might be NULL, but it's not
related because *refcounted is a value for sk, not for reuse_sk.
Powered by blists - more mailing lists