netdev - [RFC bpf-next v2 6/9] net: flow_dissector: handle no-skb use case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Mar 2019 15:19:45 -0700
From:   Stanislav Fomichev <sdf@...gle.com>
To:     netdev@...r.kernel.org, bpf@...r.kernel.org
Cc:     davem@...emloft.net, ast@...nel.org, daniel@...earbox.net,
        simon.horman@...ronome.com, willemb@...gle.com,
        peterpenkov96@...il.com, Stanislav Fomichev <sdf@...gle.com>
Subject: [RFC bpf-next v2 6/9] net: flow_dissector: handle no-skb use case

When flow_dissector is called without skb (with only data and hlen),
use temporary per-cpu skb (which has a linear chunk of data passed
to the flow dissector). This should let us handle eth_get_headlen
case where only data is provided and we don't want to (yet) allocate
an skb.

Since this per-cpu skb doesn't allocate its own data, we can't
add shinfo and need to be careful to avoid any code paths that use
it. Flow dissector BPF programs can only call bpf_skb_load_bytes helper,
which doesn't touch shinfo in our case (skb->len is the length of the
linear header so it exits early).

bpf_flow_dissect can be called only by eth_get_headlen from softirq and task
contexts:
* NIC drivers call it from .ndo_start_xmit/.ndo_change_mtu/napi->poll (softirq)
* TUN driver calls it from fops->write_iter/proto_ops->sendmsg (task)

We protect per-cpu skb by using local_bh_enable/disable, and WARN_ON if
called from interrupt context.

Note: WARN_ON_ONCE(!net) will now trigger for eth_get_headlen users.

Signed-off-by: Stanislav Fomichev <sdf@...gle.com>
---
 include/linux/skbuff.h    |  5 +++
 net/core/flow_dissector.c | 69 +++++++++++++++++++++++++++++++--------
 2 files changed, 60 insertions(+), 14 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 194dbc2985e5..e8e0f650af0a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1282,6 +1282,11 @@ bool bpf_flow_dissect_skb(struct bpf_prog *prog,
 			  const struct sk_buff *skb,
 			  struct flow_dissector *flow_dissector,
 			  struct bpf_flow_keys *flow_keys);
+bool bpf_flow_dissect(struct bpf_prog *prog,
+		      void *data, __be16 proto,
+		      int nhoff, int hlen,
+		      struct flow_dissector *flow_dissector,
+		      struct bpf_flow_keys *flow_keys);
 bool __skb_flow_dissect(struct net *net,
 			const struct sk_buff *skb,
 			struct flow_dissector *flow_dissector,
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index ab43f9bd7ec4..accf1ed460ec 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -739,6 +739,43 @@ bool bpf_flow_dissect_skb(struct bpf_prog *prog,
 	return result == BPF_OK;
 }
 
+static DEFINE_PER_CPU(struct sk_buff, bpf_flow_skb);
+
+bool bpf_flow_dissect(struct bpf_prog *prog,
+		      void *data, __be16 proto,
+		      int nhoff, int hlen,
+		      struct flow_dissector *flow_dissector,
+		      struct bpf_flow_keys *flow_keys)
+{
+	struct bpf_skb_data_end *cb;
+	struct sk_buff skb_head;
+	struct sk_buff *skb = &skb_head;
+	u32 result;
+
+	if (WARN_ON_ONCE(in_irq()))
+		return false;
+
+	local_bh_disable();
+	skb = this_cpu_ptr(&bpf_flow_skb);
+	skb->len = 0;
+	__init_skb_data(skb, data, hlen);
+	__skb_put(skb, hlen);
+	skb->protocol = proto;
+
+	init_flow_keys(flow_keys, skb, nhoff);
+
+	cb = (struct bpf_skb_data_end *)skb->cb;
+	cb->data_meta = skb->data;
+	cb->data_end  = skb->data + skb_headlen(skb);
+
+	result = BPF_PROG_RUN(prog, skb);
+
+	clamp_flow_keys(flow_keys, hlen);
+	local_bh_enable();
+
+	return result == BPF_OK;
+}
+
 /**
  * __skb_flow_dissect - extract the flow_keys struct and return it
  * @net: associated network namespace
@@ -770,8 +807,10 @@ bool __skb_flow_dissect(struct net *net,
 	struct flow_dissector_key_icmp *key_icmp;
 	struct flow_dissector_key_tags *key_tags;
 	struct flow_dissector_key_vlan *key_vlan;
-	enum flow_dissect_ret fdret;
 	enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX;
+	struct bpf_prog *attached = NULL;
+	struct bpf_flow_keys flow_keys;
+	enum flow_dissect_ret fdret;
 	int num_hdrs = 0;
 	u8 ip_proto = 0;
 	bool ret;
@@ -811,28 +850,30 @@ bool __skb_flow_dissect(struct net *net,
 					      FLOW_DISSECTOR_KEY_BASIC,
 					      target_container);
 
-	if (skb) {
-		struct bpf_flow_keys flow_keys;
-		struct bpf_prog *attached = NULL;
+	WARN_ON_ONCE(!net);
 
-		WARN_ON_ONCE(!net);
+	rcu_read_lock();
 
-		rcu_read_lock();
-		if (net)
-			attached = rcu_dereference(net->flow_dissector_prog);
+	if (net)
+		attached = rcu_dereference(net->flow_dissector_prog);
 
-		if (attached) {
+	if (attached) {
+		if (skb)
 			ret = bpf_flow_dissect_skb(attached, skb,
 						   flow_dissector,
 						   &flow_keys);
-			bpf_flow_keys_to_target(&flow_keys, flow_dissector,
-						target_container);
-			rcu_read_unlock();
-			return ret;
-		}
+		else
+			ret = bpf_flow_dissect(attached, data, proto, nhoff,
+					       hlen, flow_dissector,
+					       &flow_keys);
+		bpf_flow_keys_to_target(&flow_keys, flow_dissector,
+					target_container);
 		rcu_read_unlock();
+		return ret;
 	}
 
+	rcu_read_unlock();
+
 	if (dissector_uses_key(flow_dissector,
 			       FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
 		struct ethhdr *eth = eth_hdr(skb);
-- 
2.21.0.225.g810b269d1ac-goog