netdev - Re: [PATCH bpf 2/2] bpf: udp: Avoid calling reuseport's bpf_prog from udp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <361864C5-1353-4B41-A0C9-BD277607A809@fb.com>
Date:   Sun, 2 Jun 2019 07:05:38 +0000
From:   Song Liu <songliubraving@...com>
To:     Martin Lau <kafai@...com>
CC:     "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        David Miller <davem@...emloft.net>,
        Kernel Team <Kernel-team@...com>,
        Tom Herbert <tom@...bertland.com>
Subject: Re: [PATCH bpf 2/2] bpf: udp: Avoid calling reuseport's bpf_prog from
 udp_gro



> On Jun 1, 2019, at 6:09 PM, Martin Lau <kafai@...com> wrote:
> 
> On Sat, Jun 01, 2019 at 04:54:46PM -0700, Song Liu wrote:
>> 
>> 
>>> On May 31, 2019, at 3:29 PM, Martin KaFai Lau <kafai@...com> wrote:
>>> 
>>> When the commit a6024562ffd7 ("udp: Add GRO functions to UDP socket")
>>> added udp[46]_lib_lookup_skb to the udp_gro code path, it broke
>>> the reuseport_select_sock() assumption that skb->data is pointing
>>> to the transport header.
>>> 
>>> This patch follows an earlier __udp6_lib_err() fix by
>>> passing a NULL skb to avoid calling the reuseport's bpf_prog.
>>> 
>>> Fixes: a6024562ffd7 ("udp: Add GRO functions to UDP socket")
>>> Cc: Tom Herbert <tom@...bertland.com>
>>> Signed-off-by: Martin KaFai Lau <kafai@...com>
>>> ---
>>> net/ipv4/udp.c | 6 +++++-
>>> net/ipv6/udp.c | 2 +-
>>> 2 files changed, 6 insertions(+), 2 deletions(-)
>>> 
>>> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
>>> index 8fb250ed53d4..85db0e3d7f3f 100644
>>> --- a/net/ipv4/udp.c
>>> +++ b/net/ipv4/udp.c
>>> @@ -503,7 +503,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
> Note that this patch is changing the below "udp4_lib_lookup_skb()"
> instead of the above "__udp4_lib_lookup_skb()".
> 
>>> struct sock *udp4_lib_lookup_skb(struct sk_buff *skb,
>>> 				 __be16 sport, __be16 dport)
>>> {
>>> -	return __udp4_lib_lookup_skb(skb, sport, dport, &udp_table);
>>> +	const struct iphdr *iph = ip_hdr(skb);
>>> +
>>> +	return __udp4_lib_lookup(dev_net(skb->dev), iph->saddr, sport,
>>> +				 iph->daddr, dport, inet_iif(skb),
>>> +				 inet_sdif(skb), &udp_table, NULL);
>> 
>> I think we can now remove the last argument of __udp4_lib_lookup()?
> The last arg of __udp4_lib_lookup() is skb.
> __udp4_lib_lookup_skb(), which is not changed in this patch, is still
> calling __udp4_lib_lookup() with a skb and the skb is used by the
> reuseport's bpf_prog.  Hence, it cannot be removed.

I see. I somehow missed this path. Thanks for the explanation. 

Acked-by: Song Liu <songliubraving@...com>

> 
>> 
>> 
>>> }
>>> EXPORT_SYMBOL_GPL(udp4_lib_lookup_skb);
>>> 
>>> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
>>> index 133e6370f89c..4e52c37bb836 100644
>>> --- a/net/ipv6/udp.c
>>> +++ b/net/ipv6/udp.c
>>> @@ -243,7 +243,7 @@ struct sock *udp6_lib_lookup_skb(struct sk_buff *skb,
>>> 
>>> 	return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
>>> 				 &iph->daddr, dport, inet6_iif(skb),
>>> -				 inet6_sdif(skb), &udp_table, skb);
>>> +				 inet6_sdif(skb), &udp_table, NULL);
>>> }
>>> EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb);
>>> 
>>> -- 
>>> 2.17.1
>>> 
>>