From: Martin KaFai Lau <kafai@fb.com>
To: James Chapman <jchapman@katalix.com>
Cc: <bpf@vger.kernel.org>, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>, <kernel-team@fb.com>,
<netdev@vger.kernel.org>
Subject: Re: [PATCH v2 bpf 2/2] bpf: net: Avoid incorrect bpf_sk_reuseport_detach call
Date: Thu, 9 Jul 2020 11:47:29 -0700 [thread overview]
Message-ID: <20200709184729.jg2y2g6crxlazlqo@kafai-mbp> (raw)
In-Reply-To: <20200709105833.GA1761@katalix.com>
On Thu, Jul 09, 2020 at 11:58:33AM +0100, James Chapman wrote:
> On Wed, Jul 08, 2020 at 23:11:10 -0700, Martin KaFai Lau wrote:
> > bpf_sk_reuseport_detach is currently called when sk->sk_user_data
> > is not NULL. It is incorrect because sk->sk_user_data may not be
> > managed by the bpf's reuseport_array. It has been reported in [1] that,
> > the bpf_sk_reuseport_detach() which is called from udp_lib_unhash() has
> > corrupted the sk_user_data managed by l2tp.
> >
> > This patch solves it by using another bit (defined as SK_USER_DATA_BPF)
> > of the sk_user_data pointer value. It marks that a sk_user_data is
> > managed/owned by BPF.
>
> I have reservations about using a bit in sk_user_data to indicate
> ownership of that pointer. But putting that aside, I confirm that the
> patch fixes the problem.
>
> Acked-by: James Chapman <jchapman@katalix.com>
> Tested-by: James Chapman <jchapman@katalix.com>
> Reported-by: syzbot+9f092552ba9a5efca5df@syzkaller.appspotmail.com
Thanks for the test!
One bit of sk_user_data has already been used to indicate SK_USER_DATA_NOCOPY.
I think using another bit is the cleanest fix for the bpf/net branch instead
of tracking this somewhere else.
next prev parent reply other threads:[~2020-07-09 18:47 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-09 6:10 [PATCH v2 bpf 0/2] bpf: net: Fixes in sk_user_data of reuseport_array Martin KaFai Lau
2020-07-09 6:11 ` [PATCH v2 bpf 1/2] bpf: net: Avoid copying sk_user_data of reuseport_array during sk_clone Martin KaFai Lau
2020-07-09 16:46 ` Jakub Sitnicki
2020-07-09 20:07 ` Daniel Borkmann
2020-07-09 21:27 ` Martin KaFai Lau
2020-07-09 6:11 ` [PATCH v2 bpf 2/2] bpf: net: Avoid incorrect bpf_sk_reuseport_detach call Martin KaFai Lau
2020-07-09 10:58 ` James Chapman
2020-07-09 18:47 ` Martin KaFai Lau [this message]
2020-07-09 20:07 ` [PATCH v2 bpf 0/2] bpf: net: Fixes in sk_user_data of reuseport_array Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200709184729.jg2y2g6crxlazlqo@kafai-mbp \
--to=kafai@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=jchapman@katalix.com \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.