| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 12 Jul 2023 18:26:13 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Daniel Xu <dxu@...uu.xyz>
Cc: Andrii Nakryiko <andrii@...nel.org>,
Alexei Starovoitov <ast@...nel.org>,
Florian Westphal <fw@...len.de>,
"David S. Miller" <davem@...emloft.net>,
Pablo Neira Ayuso <pablo@...filter.org>,
Paolo Abeni <pabeni@...hat.com>,
Daniel Borkmann <daniel@...earbox.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Jozsef Kadlecsik <kadlec@...filter.org>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Song Liu <song@...nel.org>, Yonghong Song <yhs@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>,
Stanislav Fomichev <sdf@...gle.com>,
Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
bpf <bpf@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
netfilter-devel <netfilter-devel@...r.kernel.org>,
coreteam@...filter.org,
Network Development <netdev@...r.kernel.org>,
David Ahern <dsahern@...nel.org>
Subject: Re: [PATCH bpf-next v4 2/6] netfilter: bpf: Support
BPF_F_NETFILTER_IP_DEFRAG in netfilter link
On Wed, Jul 12, 2023 at 6:22 PM Daniel Xu <dxu@...uu.xyz> wrote:
>
> Hi Alexei,
>
> On Wed, Jul 12, 2023 at 05:43:49PM -0700, Alexei Starovoitov wrote:
> > On Wed, Jul 12, 2023 at 4:44 PM Daniel Xu <dxu@...uu.xyz> wrote:
> > > +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
> > > + case NFPROTO_IPV6:
> > > + rcu_read_lock();
> > > + v6_hook = rcu_dereference(nf_defrag_v6_hook);
> > > + if (!v6_hook) {
> > > + rcu_read_unlock();
> > > + err = request_module("nf_defrag_ipv6");
> > > + if (err)
> > > + return err < 0 ? err : -EINVAL;
> > > +
> > > + rcu_read_lock();
> > > + v6_hook = rcu_dereference(nf_defrag_v6_hook);
> > > + if (!v6_hook) {
> > > + WARN_ONCE(1, "nf_defrag_ipv6_hooks bad registration");
> > > + err = -ENOENT;
> > > + goto out_v6;
> > > + }
> > > + }
> > > +
> > > + err = v6_hook->enable(link->net);
> >
> > I was about to apply, but luckily caught this issue in my local test:
> >
> > [ 18.462448] BUG: sleeping function called from invalid context at
> > kernel/locking/mutex.c:283
> > [ 18.463238] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid:
> > 2042, name: test_progs
> > [ 18.463927] preempt_count: 0, expected: 0
> > [ 18.464249] RCU nest depth: 1, expected: 0
> > [ 18.464631] CPU: 15 PID: 2042 Comm: test_progs Tainted: G
> > O 6.4.0-04319-g6f6ec4fa00dc #4896
> > [ 18.465480] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> > BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
> > [ 18.466531] Call Trace:
> > [ 18.466767] <TASK>
> > [ 18.466975] dump_stack_lvl+0x32/0x40
> > [ 18.467325] __might_resched+0x129/0x180
> > [ 18.467691] mutex_lock+0x1a/0x40
> > [ 18.468057] nf_defrag_ipv4_enable+0x16/0x70
> > [ 18.468467] bpf_nf_link_attach+0x141/0x300
> > [ 18.468856] __sys_bpf+0x133e/0x26d0
> >
> > You cannot call mutex under rcu_read_lock.
>
> Whoops, my bad. I think this patch should fix it:
>
> ```
> From 7e8927c44452db07ddd7cf0e30bb49215fc044ed Mon Sep 17 00:00:00 2001
> Message-ID: <7e8927c44452db07ddd7cf0e30bb49215fc044ed.1689211250.git.dxu@...uu.xyz>
> From: Daniel Xu <dxu@...uu.xyz>
> Date: Wed, 12 Jul 2023 19:17:35 -0600
> Subject: [PATCH] netfilter: bpf: Don't hold rcu_read_lock during
> enable/disable
>
> ->enable()/->disable() takes a mutex which can sleep. You can't sleep
> during RCU read side critical section.
>
> Our refcnt on the module will protect us from ->enable()/->disable()
> from going away while we call it.
>
> Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> ---
> net/netfilter/nf_bpf_link.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c
> index 77ffbf26ba3d..79704cc596aa 100644
> --- a/net/netfilter/nf_bpf_link.c
> +++ b/net/netfilter/nf_bpf_link.c
> @@ -60,9 +60,12 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link)
> goto out_v4;
> }
>
> + rcu_read_unlock();
> err = v4_hook->enable(link->net);
> if (err)
> module_put(v4_hook->owner);
> +
> + return err;
> out_v4:
> rcu_read_unlock();
> return err;
> @@ -92,9 +95,12 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link)
> goto out_v6;
> }
>
> + rcu_read_unlock();
> err = v6_hook->enable(link->net);
> if (err)
> module_put(v6_hook->owner);
> +
> + return err;
> out_v6:
> rcu_read_unlock();
> return err;
> @@ -114,11 +120,11 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link)
> case NFPROTO_IPV4:
> rcu_read_lock();
> v4_hook = rcu_dereference(nf_defrag_v4_hook);
> + rcu_read_unlock();
> if (v4_hook) {
> v4_hook->disable(link->net);
> module_put(v4_hook->owner);
> }
> - rcu_read_unlock();
>
> break;
> #endif
> @@ -126,11 +132,11 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link)
> case NFPROTO_IPV6:
> rcu_read_lock();
> v6_hook = rcu_dereference(nf_defrag_v6_hook);
> + rcu_read_unlock();
No. v6_hook is gone as soon as you unlock it.
Powered by blists - more mailing lists