netdev - Re: [PATCH] bpf: fix size of copy_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALDO+SaVhA4GB+=-LnbZpWyx15wgc8PRFXVD4dO-O5kb+hJE9g@mail.gmail.com>
Date:	Sun, 31 Jul 2016 08:25:12 -0700
From:	William Tu <u9012063@...il.com>
To:	Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:	Daniel Borkmann <daniel@...earbox.net>,
	Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

>> >>    num_possible_cpu == 64
>> >>    num_online_cpu == 2 == sysconf(_SC_NPROCESSORS_CONF)
> ...
>> >> To fix it, I could either
>> >> 1). declare values array based on num_possible_cpu in test_map.c,
>> >>    long values[64];
>> >> or 2) in kernel, only copying 8*2 = 16 byte from kernel to user.
> ...
>> Since percpu array adds variable length of data passing between kernel
>> and userspace, I wonder if we should add a 'value_len' field in 'union
>> bpf_attr' so kernel knows how much data to copy to user?
>
> I think the first step is to figure out why num_possible is 64,
> since it hurts all per-cpu allocations. If it is a widespread issue,
> it hurts a lot of VMs.
> Hopefully it's not the case, since in my kvm setup num_possible==num_online
> qemu version 2.4.0
> booting with -enable-kvm -smp N
>
Thanks. I'm using VMware Fusion with 2 vcpu, running Fedora 23.

I tried on my another physical machine (Xeon E3), indeed
"num_possible==num_online". In fact, num_online shouldn't be an issue.
As long as num_possible == sysconf(SC_NPROCESSORS_CONF), then kernel
and user are consistent about the size of data copied.

Diving into more details:
when calling sysconf(_SC_NPROCESSORS_CONF), strace shows that it does
"open("/sys/devices/system/cpu",
O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
And in my /sys/devices/system/cpu, I have cpu0 and cpu1,
kernel_max = 63
possible = 0-63
present = 0-1

So sysconf simply reads these entries configured by kernel. Looking at
kernel code, "arch/x86/configs/x86_64_defconfig" sets
CONFIG_NR_CPUS=64, and later on set_cpu_possible() is called at
arch/x86/kernel/smpboot.c, which parses the ACPI multiprocessor table
and configured new value. Based on these observations, I think
different hypervisor may have different ways of emulating ACPI
processor table or BIOS implementation thus these values differ.

Regards,
William