netdev - Re: [PATCH bpf-next v3 5/6] bpf: sockmap: allow update from BPF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fc988cf8-e039-61f5-3d73-0ecf8f27308f@fb.com>
Date:   Fri, 21 Aug 2020 08:47:54 -0700
From:   Yonghong Song <yhs@...com>
To:     Lorenz Bauer <lmb@...udflare.com>, <jakub@...udflare.com>,
        <john.fastabend@...il.com>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
CC:     <kernel-team@...udflare.com>, <netdev@...r.kernel.org>,
        <bpf@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next v3 5/6] bpf: sockmap: allow update from BPF



On 8/21/20 3:29 AM, Lorenz Bauer wrote:
> Allow calling bpf_map_update_elem on sockmap and sockhash from a BPF
> context. The synchronization required for this is a bit fiddly: we
> need to prevent the socket from changing its state while we add it
> to the sockmap, since we rely on getting a callback via
> sk_prot->unhash. However, we can't just lock_sock like in
> sock_map_sk_acquire because that might sleep. So instead we disable
> softirq processing and use bh_lock_sock to prevent further
> modification.
> 
> Yet, this is still not enough. BPF can be called in contexts where
> the current CPU might have locked a socket. If the BPF can get
> a hold of such a socket, inserting it into a sockmap would lead to
> a deadlock. One straight forward example are sock_ops programs that
> have ctx->sk, but the same problem exists for kprobes, etc.
> We deal with this by allowing sockmap updates only from known safe
> contexts. Improper usage is rejected by the verifier.
> 
> I've audited the enabled contexts to make sure they can't run in
> a locked context. It's possible that CGROUP_SKB and others are
> safe as well, but the auditing here is much more difficult. In
> any case, we can extend the safe contexts when the need arises.
> 
> Signed-off-by: Lorenz Bauer <lmb@...udflare.com>

Acked-by: Yonghong Song <yhs@...com>