lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 23 Nov 2019 12:07:48 +0100 From: Jakub Sitnicki <jakub@...udflare.com> To: bpf@...r.kernel.org Cc: netdev@...r.kernel.org, kernel-team@...udflare.com, John Fastabend <john.fastabend@...il.com>, Martin KaFai Lau <kafai@...com> Subject: [PATCH bpf-next 5/8] bpf: Allow selecting reuseport socket from a SOCKMAP SOCKMAP now supports storing references to listening sockets. Nothing keeps us from using it as an array of sockets to select from in SK_REUSEPORT programs. Whitelist the map type with the BPF helper for selecting socket. However, impose a restriction that the selected socket needs to be a listening TCP socket or a bound UDP socket (connected or not). The only other map type that works with the BPF reuseport helper, REUSEPORT_SOCKARRAY, has a corresponding check in its update operation handler. Signed-off-by: Jakub Sitnicki <jakub@...udflare.com> --- kernel/bpf/verifier.c | 6 ++++-- net/core/filter.c | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a0482e1c4a77..111a1eb543ab 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3685,7 +3685,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, if (func_id != BPF_FUNC_sk_redirect_map && func_id != BPF_FUNC_sock_map_update && func_id != BPF_FUNC_map_delete_elem && - func_id != BPF_FUNC_msg_redirect_map) + func_id != BPF_FUNC_msg_redirect_map && + func_id != BPF_FUNC_sk_select_reuseport) goto error; break; case BPF_MAP_TYPE_SOCKHASH: @@ -3766,7 +3767,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, goto error; break; case BPF_FUNC_sk_select_reuseport: - if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY) + if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY && + map->map_type != BPF_MAP_TYPE_SOCKMAP) goto error; break; case BPF_FUNC_map_peek_elem: diff --git a/net/core/filter.c b/net/core/filter.c index 49ded4a7588a..e3fb77353248 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8723,6 +8723,8 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, selected_sk = map->ops->map_lookup_elem(map, key); if (!selected_sk) return -ENOENT; + if (!sock_flag(selected_sk, SOCK_RCU_FREE)) + return -EINVAL; reuse = rcu_dereference(selected_sk->sk_reuseport_cb); if (!reuse) -- 2.20.1
Powered by blists - more mailing lists