[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ccd708bf-580a-3d24-e5be-4e7dc12e7b39@iogearbox.net>
Date: Thu, 12 Sep 2024 17:03:15 +0200
From: Daniel Borkmann <daniel@...earbox.net>
To: Breno Leitao <leitao@...ian.org>,
Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc: Jakub Kicinski <kuba@...nel.org>, razor@...ckwall.org, andrii@...nel.org,
ast@...nel.org,
syzbot <syzbot+08811615f0e17bc6708b@...kaller.appspotmail.com>,
bpf@...r.kernel.org, davem@...emloft.net, eddyz87@...il.com,
haoluo@...gle.com, hawk@...nel.org, john.fastabend@...il.com,
jolsa@...nel.org, kpsingh@...nel.org, linux-kernel@...r.kernel.org,
martin.lau@...ux.dev, netdev@...r.kernel.org, sdf@...ichev.me,
song@...nel.org, syzkaller-bugs@...glegroups.com, yonghong.song@...ux.dev
Subject: Re: [PATCH net-net] tun: Assign missing bpf_net_context.
On 9/12/24 3:17 PM, Breno Leitao wrote:
> On Thu, Sep 12, 2024 at 02:28:47PM +0200, Sebastian Andrzej Siewior wrote:
>> On 2024-09-12 05:06:36 [-0700], Breno Leitao wrote:
>>> Hello Sebastian, Jakub,
>> Hi,
>>
>>> I've seen some crashes in 6.11-rc7 that seems related to 401cb7dae8130
>>> ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.").
>>>
>>> Basically bpf_net_context is NULL, and it is being dereferenced by
>>> bpf_net_ctx->ri.kern_flags (offset 0x38) in the following code.
>>>
>>> static inline struct bpf_redirect_info *bpf_net_ctx_get_ri(void)
>>> {
>>> struct bpf_net_context *bpf_net_ctx = bpf_net_ctx_get();
>>> if (!(bpf_net_ctx->ri.kern_flags & BPF_RI_F_RI_INIT)) {
>>>
>>> That said, it means that bpf_net_ctx_get() is returning NULL.
>>>
>>> This stack is coming from the bpf function bpf_redirect()
>>> BPF_CALL_2(bpf_redirect, u32, ifindex, u64, flags)
>>> {
>>> struct bpf_redirect_info *ri = bpf_net_ctx_get_ri();
>>>
>>>
>>> Since I don't think there is XDP involved, I wondering if we need some
>>> preotection before calling bpf_redirect()
>>
>> This origins in netkit_xmit(). If my memory serves me, then Daniel told
>> me that netkit is not doing any redirect and therefore does not need
>> "this". This must have been during one of the first "designs"/ versions.
>
> Right, I've seen several crashes related to this, and in all of them it
> is through netkit_xmit() -> netkit_run() -> bpf_prog_run()
>
>> If you are saying, that this is possible then something must be done.
>> Either assign a context or reject the bpf program.
>
> If we want to assign a context, do you meant something like the
> following?
>
> Author: Breno Leitao <leitao@...ian.org>
> Date: Thu Sep 12 06:11:28 2024 -0700
>
> netkit: Assign missing bpf_net_context.
>
> During the introduction of struct bpf_net_context handling for
> XDP-redirect, the netkit driver has been missed.
>
> Set the bpf_net_context before invoking netkit_xmit() program within the
> netkit driver.
>
> Fixes: 401cb7dae8130 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.")
> Signed-off-by: Breno Leitao <leitao@...ian.org>
Oh well, quite annoying that we need this context now everywhere also outside of XDP :(
Sebastian, do you see any way where this could be noop for !PREEMPT_RT?
Anyway, fix looks good to me, thanks!
Acked-by: Daniel Borkmann <daniel@...earbox.net>
> diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c
> index 79232f5cc088..f8af57b7a1e8 100644
> --- a/drivers/net/netkit.c
> +++ b/drivers/net/netkit.c
> @@ -65,6 +65,7 @@ static struct netkit *netkit_priv(const struct net_device *dev)
>
> static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
> {
> + struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx;
> struct netkit *nk = netkit_priv(dev);
> enum netkit_action ret = READ_ONCE(nk->policy);
> netdev_tx_t ret_dev = NET_XMIT_SUCCESS;
> @@ -72,6 +73,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
> struct net_device *peer;
> int len = skb->len;
>
> + bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx);
> rcu_read_lock();
> peer = rcu_dereference(nk->peer);
> if (unlikely(!peer || !(peer->flags & IFF_UP) ||
> @@ -110,6 +112,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev)
> break;
> }
> rcu_read_unlock();
> + bpf_net_ctx_clear(bpf_net_ctx);
> return ret_dev;
> }
>
Powered by blists - more mailing lists