netdev - Re: [Intel-wired-lan] [PATCH iwl-next] ice: allow hot-swapping XDP programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Jun 2023 17:15:15 +0200
From: Alexander Lobakin <aleksander.lobakin@...el.com>
To: Maciej Fijalkowski <maciej.fijalkowski@...el.com>
CC: <intel-wired-lan@...ts.osuosl.org>, <netdev@...r.kernel.org>,
	<anthony.l.nguyen@...el.com>, <fred@...udflare.com>,
	<magnus.karlsson@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH iwl-next] ice: allow hot-swapping XDP
 programs

From: Maciej Fijalkowski <maciej.fijalkowski@...el.com>
Date: Tue, 13 Jun 2023 17:10:05 +0200

> Currently ice driver's .ndo_bpf callback brings the interface down and
> up independently of the presence of XDP resources. This is only needed
> when either these resources have to be configured or removed. It means
> that if one is switching XDP programs on-the-fly with running traffic,
> packets will be dropped.
> 
> To avoid this, compare early on ice_xdp_setup_prog() state of incoming
> bpf_prog pointer vs the bpf_prog pointer that is already assigned to
> VSI. Do the swap in case VSI has bpf_prog and incoming one are non-NULL.
> 
> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@...el.com>

[0] :D

But if be serious, are you sure you won't have any pointer tears /
partial reads/writes without such RCU protection as added in the
linked commit ?

> ---
>  drivers/net/ethernet/intel/ice/ice_main.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
> index a1f7c8edc22f..8940ee505811 100644
> --- a/drivers/net/ethernet/intel/ice/ice_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_main.c
> @@ -2922,6 +2922,11 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog,
>  					   "MTU is too large for linear frames and XDP prog does not support frags");
>  			return -EOPNOTSUPP;
>  		}
> +
> +	/* hot swap progs and avoid toggling link */
> +	if (ice_is_xdp_ena_vsi(vsi) == !!prog) {
> +		ice_vsi_assign_bpf_prog(vsi, prog);
> +		return 0;
>  	}
>  
>  	/* need to stop netdev while setting up the program for Rx rings */
> @@ -2956,13 +2961,6 @@ ice_xdp_setup_prog(struct ice_vsi *vsi, struct bpf_prog *prog,
>  		xdp_ring_err = ice_realloc_zc_buf(vsi, false);
>  		if (xdp_ring_err)
>  			NL_SET_ERR_MSG_MOD(extack, "Freeing XDP Rx resources failed");
> -	} else {
> -		/* safe to call even when prog == vsi->xdp_prog as
> -		 * dev_xdp_install in net/core/dev.c incremented prog's
> -		 * refcount so corresponding bpf_prog_put won't cause
> -		 * underflow
> -		 */
> -		ice_vsi_assign_bpf_prog(vsi, prog);
>  	}
>  
>  	if (if_running)

[0]
https://github.com/alobakin/linux/commit/5645adb0943dabeadfb9f6d00202c78fb9594fbe

Thanks,
Olek