netdev - Re: [PATCH bpf 2/2] bpf: udp: Avoid calling reuseport's bpf_prog from udp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 2 Jun 2019 01:09:29 +0000
From:   Martin Lau <kafai@...com>
To:     Song Liu <songliubraving@...com>
CC:     "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        David Miller <davem@...emloft.net>,
        Kernel Team <Kernel-team@...com>,
        Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH bpf 2/2] bpf: udp: Avoid calling reuseport's bpf_prog from
 udp_gro

On Sat, Jun 01, 2019 at 04:54:46PM -0700, Song Liu wrote:
> 
> 
> > On May 31, 2019, at 3:29 PM, Martin KaFai Lau <kafai@...com> wrote:
> > 
> > When the commit a6024562ffd7 ("udp: Add GRO functions to UDP socket")
> > added udp[46]_lib_lookup_skb to the udp_gro code path, it broke
> > the reuseport_select_sock() assumption that skb->data is pointing
> > to the transport header.
> > 
> > This patch follows an earlier __udp6_lib_err() fix by
> > passing a NULL skb to avoid calling the reuseport's bpf_prog.
> > 
> > Fixes: a6024562ffd7 ("udp: Add GRO functions to UDP socket")
> > Cc: Tom Herbert <tom@...bertland.com>
> > Signed-off-by: Martin KaFai Lau <kafai@...com>
> > ---
> > net/ipv4/udp.c | 6 +++++-
> > net/ipv6/udp.c | 2 +-
> > 2 files changed, 6 insertions(+), 2 deletions(-)
> > 
> > diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> > index 8fb250ed53d4..85db0e3d7f3f 100644
> > --- a/net/ipv4/udp.c
> > +++ b/net/ipv4/udp.c
> > @@ -503,7 +503,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
Note that this patch is changing the below "udp4_lib_lookup_skb()"
instead of the above "__udp4_lib_lookup_skb()".

> > struct sock *udp4_lib_lookup_skb(struct sk_buff *skb,
> > 				 __be16 sport, __be16 dport)
> > {
> > -	return __udp4_lib_lookup_skb(skb, sport, dport, &udp_table);
> > +	const struct iphdr *iph = ip_hdr(skb);
> > +
> > +	return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport,
> > +				 iph->daddr, dport, inet_iif(skb),
> > +				 inet_sdif(skb), &udp_table, NULL);
> 
> I think we can now remove the last argument of __udp4_lib_lookup()?
The last arg of __udp4_lib_lookup() is skb.
__udp4_lib_lookup_skb(), which is not changed in this patch, is still
calling __udp4_lib_lookup() with a skb and the skb is used by the
reuseport's bpf_prog.  Hence, it cannot be removed.

> 
> 
> > }
> > EXPORT_SYMBOL_GPL(udp4_lib_lookup_skb);
> > 
> > diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> > index 133e6370f89c..4e52c37bb836 100644
> > --- a/net/ipv6/udp.c
> > +++ b/net/ipv6/udp.c
> > @@ -243,7 +243,7 @@ struct sock *udp6_lib_lookup_skb(struct sk_buff *skb,
> > 
> > 	return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
> > 				 &iph->daddr, dport, inet6_iif(skb),
> > -				 inet6_sdif(skb), &udp_table, skb);
> > +				 inet6_sdif(skb), &udp_table, NULL);
> > }
> > EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb);
> > 
> > -- 
> > 2.17.1
> > 
>