netdev - Re: [PATCH bpf] xdp: Handle device unregister for devmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2d516208-8c46-707c-4484-4547e66fc128@i-love.sakura.ne.jp>
Date:   Thu, 17 Oct 2019 05:09:07 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     Toke Høiland-Jørgensen <toke@...hat.com>
Cc:     daniel@...earbox.net, ast@...com, bpf@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH bpf] xdp: Handle device unregister for devmap_hash map
 type

On 2019/10/16 22:28, Toke Høiland-Jørgensen wrote:
> It seems I forgot to add handling of devmap_hash type maps to the device
> unregister hook for devmaps. This omission causes devices to not be
> properly released, which causes hangs.
> 
> Fix this by adding the missing handler.
> 
> Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index")
> Reported-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Signed-off-by: Toke Høiland-Jørgensen <toke@...hat.com>

Well, regarding 6f9d451ab1a3, I think that we want explicit "(u64)" cast

@@ -97,6 +123,14 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
        cost = (u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *);
        cost += sizeof(struct list_head) * num_possible_cpus();

+       if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+               dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
+
+               if (!dtab->n_buckets) /* Overflow check */
+                       return -EINVAL;
+               cost += sizeof(struct hlist_head) * dtab->n_buckets;

                                                    ^here

+       }
+
        /* if map size is larger than memlock limit, reject it */
        err = bpf_map_charge_init(&dtab->map.memory, cost);
        if (err)

like "(u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *)" does.
Otherwise, on 32bits build, "sizeof(struct hlist_head) * dtab->n_buckets" can become 0.

----------
#include <stdio.h>
#include <linux/types.h>

int main(int argc, char *argv[])
{
        volatile __u32 i = 4294967296ULL / sizeof(unsigned long *);
        volatile __u64 cost = sizeof(unsigned long *) * i;

        printf("cost=%llu\n", (unsigned long long) cost);
        return 0;
}
----------