netdev - [PATCH bpf-next] bpf, sockmap: Manual deletion of sockmap elements in user mode is not allowed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220314124432.3050394-1-wangyufen@huawei.com>
Date:   Mon, 14 Mar 2022 20:44:32 +0800
From:   Wang Yufen <wangyufen@...wei.com>
To:     <ast@...nel.org>, <john.fastabend@...il.com>,
        <daniel@...earbox.net>, <jakub@...udflare.com>,
        <lmb@...udflare.com>, <davem@...emloft.net>, <kafai@...com>,
        <dsahern@...nel.org>, <kuba@...nel.org>, <songliubraving@...com>,
        <yhs@...com>, <kpsingh@...nel.org>
CC:     <netdev@...r.kernel.org>, <bpf@...r.kernel.org>,
        Wang Yufen <wangyufen@...wei.com>
Subject: [PATCH bpf-next] bpf, sockmap: Manual deletion of sockmap elements in user mode is not allowed

A tcp socket in a sockmap. If user invokes bpf_map_delete_elem to delete
the sockmap element, the tcp socket will switch to use the TCP protocol
stack to send and receive packets. The switching process may cause some
issues, such as if some msgs exist in the ingress queue and are cleared
by sk_psock_drop(), the packets are lost, and the tcp data is abnormal.

Signed-off-by: Wang Yufen <wangyufen@...wei.com>
---
 include/uapi/linux/bpf.h | 3 +++
 kernel/bpf/syscall.c     | 2 ++
 net/core/sock_map.c      | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 4eebea830613..1dab090f271c 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1218,6 +1218,9 @@ enum {
 
 /* Create a map that is suitable to be an inner map with dynamic max entries */
 	BPF_F_INNER_MAP		= (1U << 12),
+
+/* This should only be used for bpf_map_delete_elem called by user. */
+	BPF_F_TCP_SOCKMAP	= (1U << 13),
 };
 
 /* Flags for BPF_PROG_QUERY. */
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index db402ebc5570..57aa98087322 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1232,7 +1232,9 @@ static int map_delete_elem(union bpf_attr *attr)
 
 	bpf_disable_instrumentation();
 	rcu_read_lock();
+	map->map_flags |= BPF_F_TCP_SOCKMAP;
 	err = map->ops->map_delete_elem(map, key);
+	map->map_flags &= ~BPF_F_TCP_SOCKMAP;
 	rcu_read_unlock();
 	bpf_enable_instrumentation();
 	maybe_wait_bpf_programs(map);
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 2d213c4011db..5b90a35d1d23 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -914,6 +914,9 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
 	struct bpf_shtab_elem *elem;
 	int ret = -ENOENT;
 
+	if (map->map_flags & BPF_F_TCP_SOCKMAP)
+		return -EOPNOTSUPP;
+
 	hash = sock_hash_bucket_hash(key, key_size);
 	bucket = sock_hash_select_bucket(htab, hash);
 
-- 
2.25.1