[PATCH bpf] bpf: devmap: fix wrong interface selection in notifier_call

[PATCH bpf] bpf: devmap: fix wrong interface selection in notifier_call

[Taehee Yoo]

The dev_map_notification() removes interface in devmap if
unregistering interface's ifindex is same.
But only checking ifindex is not enough because other netns can have
same ifindex. so that wrong interface selection could occurred.
Hence the net_eq() is needed.

Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
---
 kernel/bpf/devmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 141710b82a6c..0d9211e49a4a 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -496,6 +496,7 @@ static int dev_map_notification(struct notifier_block *notifier,
 				ulong event, void *ptr)
 {
 	struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
+	struct net *net = dev_net(netdev);
 	struct bpf_dtab *dtab;
 	int i;
 
@@ -512,7 +513,7 @@ static int dev_map_notification(struct notifier_block *notifier,
 				struct bpf_dtab_netdev *dev, *odev;
 
 				dev = READ_ONCE(dtab->netdev_map[i]);
-				if (!dev ||
+				if (!dev || !net_eq(net, dev_net(dev->dev)) ||
 				    dev->dev->ifindex != netdev->ifindex)
 					continue;
 				odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
-- 
2.17.1

Re: [PATCH bpf] bpf: devmap: fix wrong interface selection in notifier_call

[Daniel Borkmann]

[ +John ]

On 10/22/2018 05:41 PM, Taehee Yoo wrote:
> The dev_map_notification() removes interface in devmap if
> unregistering interface's ifindex is same.
> But only checking ifindex is not enough because other netns can have
> same ifindex. so that wrong interface selection could occurred.
> Hence the net_eq() is needed.
> 
> Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> ---
>  kernel/bpf/devmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
> index 141710b82a6c..0d9211e49a4a 100644
> --- a/kernel/bpf/devmap.c
> +++ b/kernel/bpf/devmap.c
> @@ -496,6 +496,7 @@ static int dev_map_notification(struct notifier_block *notifier,
>  				ulong event, void *ptr)
>  {
>  	struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
> +	struct net *net = dev_net(netdev);
>  	struct bpf_dtab *dtab;
>  	int i;
>  
> @@ -512,7 +513,7 @@ static int dev_map_notification(struct notifier_block *notifier,
>  				struct bpf_dtab_netdev *dev, *odev;
>  
>  				dev = READ_ONCE(dtab->netdev_map[i]);
> -				if (!dev ||
> +				if (!dev || !net_eq(net, dev_net(dev->dev)) ||
>  				    dev->dev->ifindex != netdev->ifindex)

Can't we just compare netdev pointers directly here?

>  					continue;
>  				odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
> 

Re: [PATCH bpf] bpf: devmap: fix wrong interface selection in notifier_call

[Taehee Yoo]

Hi Daniel!

On Wed, 24 Oct 2018 at 18:07, Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> [ +John ]
>
> On 10/22/2018 05:41 PM, Taehee Yoo wrote:
> > The dev_map_notification() removes interface in devmap if
> > unregistering interface's ifindex is same.
> > But only checking ifindex is not enough because other netns can have
> > same ifindex. so that wrong interface selection could occurred.
> > Hence the net_eq() is needed.
> >
> > Fixes: 2ddf71e23cc2 ("net: add notifier hooks for devmap bpf map")
> > Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> > ---
> >  kernel/bpf/devmap.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
> > index 141710b82a6c..0d9211e49a4a 100644
> > --- a/kernel/bpf/devmap.c
> > +++ b/kernel/bpf/devmap.c
> > @@ -496,6 +496,7 @@ static int dev_map_notification(struct notifier_block *notifier,
> >                               ulong event, void *ptr)
> >  {
> >       struct net_device *netdev = netdev_notifier_info_to_dev(ptr);
> > +     struct net *net = dev_net(netdev);
> >       struct bpf_dtab *dtab;
> >       int i;
> >
> > @@ -512,7 +513,7 @@ static int dev_map_notification(struct notifier_block *notifier,
> >                               struct bpf_dtab_netdev *dev, *odev;
> >
> >                               dev = READ_ONCE(dtab->netdev_map[i]);
> > -                             if (!dev ||
> > +                             if (!dev || !net_eq(net, dev_net(dev->dev)) ||
> >                                   dev->dev->ifindex != netdev->ifindex)
>
> Can't we just compare netdev pointers directly here?
>

Thank you for review!
I tested what you suggested, It works well and it's more simple.
So that I will send v2 patch that just compares netdev pointer instead of
using ifindex and net_eq().

> >                                       continue;
> >                               odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
> >
>

Thanks!