netdev - Re: [PATCH bpf-next v4 2/3] net/smc: bpf: Introduce generic hook for handshake flow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <5866d0686028b734879265d8a47af12347e262a26ce86b0ab452b5d2a185d457@mail.kernel.org>
Date: Mon,  3 Nov 2025 07:55:35 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: alibuda@...ux.alibaba.com,ast@...nel.org,daniel@...earbox.net,andrii@...nel.org,martin.lau@...ux.dev,pabeni@...hat.com,song@...nel.org,sdf@...gle.com,haoluo@...gle.com,yhs@...com,edumazet@...gle.com,john.fastabend@...il.com,kpsingh@...nel.org,jolsa@...nel.org,mjambigi@...ux.ibm.com,wenjia@...ux.ibm.com,wintera@...ux.ibm.com,dust.li@...ux.alibaba.com,tonylu@...ux.alibaba.com,guwen@...ux.alibaba.com
Cc: bpf@...r.kernel.org,davem@...emloft.net,kuba@...nel.org,netdev@...r.kernel.org,sidraya@...ux.ibm.com,jaka@...ux.ibm.com,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCH bpf-next v4 2/3] net/smc: bpf: Introduce generic hook for handshake flow


```
commit b661eee197ec1c841de9195f171863daef37de34
Author: D. Wythe <alibuda@...ux.alibaba.com>

net/smc: bpf: Introduce generic hook for handshake flow

This patch introduces a BPF struct_ops mechanism that allows eBPF
programs to control SMC protocol handshake decisions at runtime based on
connection properties like IP addresses and ports.

> diff --git a/net/smc/smc_sysctl.c b/net/smc/smc_sysctl.c
> index 2fab6456f..918516734 100644
> --- a/net/smc/smc_sysctl.c
> +++ b/net/smc/smc_sysctl.c

[ ... ]

> +#if IS_ENABLED(CONFIG_SMC_HS_CTRL_BPF)
> +static int smc_net_replace_smc_hs_ctrl(struct net *net, const char *name)
> +{
> +	struct smc_hs_ctrl *ctrl = NULL;
> +
> +	rcu_read_lock();
> +	/* null or empty name ask to clear current ctrl */
> +	if (name && name[0]) {
> +		ctrl = smc_hs_ctrl_find_by_name(name);
> +		if (!ctrl) {
> +			rcu_read_unlock();
> +			return -EINVAL;
> +		}
> +		/* no change, just return */
> +		if (ctrl == rcu_dereference(net->smc.hs_ctrl)) {
> +			rcu_read_unlock();
> +			return 0;
> +		}
> +		if (!bpf_try_module_get(ctrl, ctrl->owner)) {
> +			rcu_read_unlock();
> +			return -EBUSY;
> +		}
> +	}
> +	/* xhcg old ctrl with the new one atomically */
> +	ctrl = unrcu_pointer(xchg(&net->smc.hs_ctrl, RCU_INITIALIZER(ctrl)));
> +	/* release old ctrl */
> +	if (ctrl)
> +		bpf_module_put(ctrl, ctrl->owner);
> +
> +	rcu_read_unlock();
> +	return 0;
> +}

Can concurrent sysctl writes race in smc_net_replace_smc_hs_ctrl? If
two threads both write the same ctrl name to the hs_ctrl sysctl:

Thread A: finds ctrl, bpf_try_module_get(ctrl) succeeds (refcount++)
Thread B: finds ctrl, bpf_try_module_get(ctrl) succeeds (refcount++)
Thread A: xchg(&net->smc.hs_ctrl, ctrl) returns old_ctrl
Thread B: xchg(&net->smc.hs_ctrl, ctrl) returns ctrl (from Thread A)
Thread A: bpf_module_put(old_ctrl)
Thread B: bpf_module_put(ctrl)  <- drops ref on ctrl still in use

This leaves ctrl with one less reference than needed while it's assigned
to net->smc.hs_ctrl, and old_ctrl leaks a reference. The xchg is atomic
but the overall get-xchg-put sequence is not. Would a mutex around the
entire operation resolve this?

> +
> +static int proc_smc_hs_ctrl(const struct ctl_table *ctl, int write,
> +			    void *buffer, size_t *lenp, loff_t *ppos)
> +{
> +	struct net *net = container_of(ctl->data, struct net, smc.hs_ctrl);
> +	char val[SMC_HS_CTRL_NAME_MAX];
> +	const struct ctl_table tbl = {
> +		.data = val,
> +		.maxlen = SMC_HS_CTRL_NAME_MAX,
> +	};
> +	struct smc_hs_ctrl *ctrl;
> +	int ret;
> +
> +	rcu_read_lock();
> +	ctrl = rcu_dereference(net->smc.hs_ctrl);
> +	if (ctrl)
> +		memcpy(val, ctrl->name, sizeof(ctrl->name));
> +	else
> +		val[0] = '\0';
> +	rcu_read_unlock();
> +
> +	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
> +	if (ret)
> +		return ret;
> +
> +	if (write)
> +		ret = smc_net_replace_smc_hs_ctrl(net, val);
> +	return ret;
> +}

[ ... ]


```

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

In-Reply-To-Subject: `net/smc: bpf: Introduce generic hook for handshake flow`
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19027307093