netdev - Re: [PATCH bpf-next] bpf,sockmap: fix sk->sk_forward_alloc warn_on in sk_stream_kill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 28 May 2022 09:54:40 +0800
From:   wangyufen <wangyufen@...wei.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
CC:     <ast@...nel.org>, <john.fastabend@...il.com>, <andrii@...nel.org>,
        <daniel@...earbox.net>, <jakub@...udflare.com>,
        <lmb@...udflare.com>, <davem@...emloft.net>, <kafai@...com>,
        <dsahern@...nel.org>, <kuba@...nel.org>, <songliubraving@...com>,
        <yhs@...com>, <kpsingh@...nel.org>, <netdev@...r.kernel.org>,
        <bpf@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf,sockmap: fix sk->sk_forward_alloc warn_on in
 sk_stream_kill_queues


在 2022/5/28 5:37, Cong Wang 写道:
> On Tue, May 24, 2022 at 03:53:11PM +0800, Wang Yufen wrote:
>> During TCP sockmap redirect pressure test, the following warning is triggered:
>> WARNING: CPU: 3 PID: 2145 at net/core/stream.c:205 sk_stream_kill_queues+0xbc/0xd0
>> CPU: 3 PID: 2145 Comm: iperf Kdump: loaded Tainted: G        W         5.10.0+ #9
>> Call Trace:
>>   inet_csk_destroy_sock+0x55/0x110
>>   inet_csk_listen_stop+0xbb/0x380
>>   tcp_close+0x41b/0x480
>>   inet_release+0x42/0x80
>>   __sock_release+0x3d/0xa0
>>   sock_close+0x11/0x20
>>   __fput+0x9d/0x240
>>   task_work_run+0x62/0x90
>>   exit_to_user_mode_prepare+0x110/0x120
>>   syscall_exit_to_user_mode+0x27/0x190
>>   entry_SYSCALL_64_after_hwframe+0x44/0xa9
>>
>> The reason we observed is that:
>> When the listener is closing, a connection may have completed the three-way
>> handshake but not accepted, and the client has sent some packets. The child
>> sks in accept queue release by inet_child_forget()->inet_csk_destroy_sock(),
>> but psocks of child sks have not released.
>>
> Hm, in this scenario, how does the child socket end up in the sockmap?
> Clearly user-space does not have a chance to get an fd yet.
>
> And, how does your patch work? Since the child sock does not even inheirt
> the sock proto after clone (see the comments above tcp_bpf_clone()) at
> all?
>
> Thanks.
> .
My test cases are as follows:

__section("sockops")
int bpf_sockmap(struct bpf_sock_ops *skops)
{
     switch (skops->op) {
         case BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB:
         case BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB:
             ...
             bpf_sock_hash_update(skops, &sock_ops_map, &key, BPF_NOEXIST);
             break;
         ...
}

__section("sk_msg")
int bpf_redir(struct sk_msg_md *msg)
{
     ...
     bpf_msg_redirect_hash(msg, &sock_ops_map, &key, BPF_F_INGRESS);
     return SK_PASS;
}

//tcp_server
int main(char **argv)
{
     int sk = 0;
     int port, ret;
     struct sockaddr_in addr;

     signal(SIGCHLD, SIG_IGN);

     sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
     if (sk < 0) {
         perror("Can't create socket");
         return -1;
     }

     port = atoi(argv[1]);
     memset(&addr, 0, sizeof(addr));
     addr.sin_family = AF_INET;
     addr.sin_addr.s_addr = htonl(INADDR_ANY);
     addr.sin_port = htons(port);

     printf("Binding to port %d\n", port);

     ret = bind(sk, (struct sockaddr *)&addr, sizeof(addr));
     if (ret < 0) {
         perror("Can't bind socket");
         return -1;
     }

     ret = listen(sk, size);
     if (ret < 0) {
         perror("Can't put sock to listen");
         return -1;
     }

     printf("Waiting for connections\n");
     while (1) {
         //not accpet
         sleep(1);
     }
}

//tcp_client
int main(char **argv)
{
     int port, write_size;
     int val[10], rval[10];
     int sk = 0;

     port = atoi(argv[2]);
     val[0] = 1;

     sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
     if (sk < 0) {
         perror("Can't create socket");
         return -1;
     }

     memset(&addr, 0, sizeof(addr));
     addr.sin_family = AF_INET;
     inet_aton(argv[1], &addr.sin_addr);
     addr.sin_port = htons(port);

     ret = connect(sk[i], (struct sockaddr *)&addr, sizeof(addr));
     if (ret < 0) {
         perror("Can't connect");
         return -1;
     }

    while (1) {
         printf("send %d -> %d\n", val[0], val[0]);
         write(sk, &val, sizeof(val));
         val[0]++;
         sleep(1);
    }
}


1. start tcp_server
2. start tcp_client
3. kill tcp_server
The problem can be reproduced easily.