From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63351C43387 for ; Thu, 17 Jan 2019 13:06:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 38E3E20657 for ; Thu, 17 Jan 2019 13:06:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726820AbfAQNGF (ORCPT ); Thu, 17 Jan 2019 08:06:05 -0500 Received: from mx1.redhat.com ([209.132.183.28]:54459 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725933AbfAQNGE (ORCPT ); Thu, 17 Jan 2019 08:06:04 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0335EC049D79; Thu, 17 Jan 2019 13:06:04 +0000 (UTC) Received: from [10.72.12.16] (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 5D366601A6; Thu, 17 Jan 2019 13:05:51 +0000 (UTC) Subject: Re: [PATCH net 5/7] virtio_net: Don't process redirected XDP frames when XDP is disabled From: Jason Wang To: Toshiaki Makita , "David S. Miller" , "Michael S. Tsirkin" Cc: netdev@vger.kernel.org, virtualization@lists.linux-foundation.org, Jesper Dangaard Brouer References: <1547724045-2726-1-git-send-email-makita.toshiaki@lab.ntt.co.jp> <1547724045-2726-6-git-send-email-makita.toshiaki@lab.ntt.co.jp> Message-ID: <24359f65-fe45-46d1-5344-f0cc4705009b@redhat.com> Date: Thu, 17 Jan 2019 21:05:47 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 17 Jan 2019 13:06:04 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 2019/1/17 下午8:53, Jason Wang wrote: > > On 2019/1/17 下午7:20, Toshiaki Makita wrote: >> Commit 8dcc5b0ab0ec ("virtio_net: fix ndo_xdp_xmit crash towards dev not >> ready for XDP") tried to avoid access to unexpected sq while XDP is >> disabled, but was not complete. >> >> There was a small window which causes out of bounds sq access in >> virtnet_xdp_xmit() while disabling XDP. >> >> An example case of >>   - curr_queue_pairs = 6 (2 for SKB and 4 for XDP) >>   - online_cpu_num = xdp_queue_paris = 4 >> when XDP is enabled: >> >> CPU 0                         CPU 1 >> (Disabling XDP)               (Processing redirected XDP frames) >> >>                                virtnet_xdp_xmit() >> virtnet_xdp_set() >>   _virtnet_set_queues() >>    set curr_queue_pairs (2) >>                                 check if rq->xdp_prog is not NULL >>                                 virtnet_xdp_sq(vi) >>                                  qp = curr_queue_pairs - >>                                       xdp_queue_pairs + >>                                       smp_processor_id() >>                                     = 2 - 4 + 1 = -1 >>                                  sq = &vi->sq[qp] // out of bounds >> access >>    set xdp_queue_pairs (0) >>    rq->xdp_prog = NULL >> >> Basically we should not change curr_queue_pairs and xdp_queue_pairs >> while someone can read the values. Thus, when disabling XDP, assign NULL >> to rq->xdp_prog first, and wait for RCU grace period, then change >> xxx_queue_pairs. >> Note that we need to keep the current order when enabling XDP though. >> >> Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT") >> Signed-off-by: Toshiaki Makita > > > I wonder whether or not we could simply do: > > > if (prog) { Should be !prog > >     rcu_assign_pointer() > >     synchronize_net() > > } > > set queues > > if (!prog) { Should be prog. Thanks > >     rcu_assign_pointer() > > } > > Thanks > > >> --- >>   drivers/net/virtio_net.c | 32 +++++++++++++++++++++++++------- >>   1 file changed, 25 insertions(+), 7 deletions(-) >> >> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c >> index 204eedf..ae93f0e 100644 >> --- a/drivers/net/virtio_net.c >> +++ b/drivers/net/virtio_net.c >> @@ -2424,14 +2424,16 @@ static int virtnet_xdp_set(struct net_device >> *dev, struct bpf_prog *prog, >>           } >>       } >>   -    err = _virtnet_set_queues(vi, curr_qp + xdp_qp); >> -    if (err) >> -        goto err; >> -    netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp); >> -    vi->xdp_queue_pairs = xdp_qp; >> +    old_prog = rtnl_dereference(vi->rq[0].xdp_prog); >> +    if (!old_prog && prog) { >> +        err = _virtnet_set_queues(vi, curr_qp + xdp_qp); >> +        if (err) >> +            goto err_new_prog; >> +        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp); >> +        vi->xdp_queue_pairs = xdp_qp; >> +    } >>         for (i = 0; i < vi->max_queue_pairs; i++) { >> -        old_prog = rtnl_dereference(vi->rq[i].xdp_prog); >>           rcu_assign_pointer(vi->rq[i].xdp_prog, prog); >>           if (i == 0) { >>               if (!old_prog) >> @@ -2439,6 +2441,18 @@ static int virtnet_xdp_set(struct net_device >> *dev, struct bpf_prog *prog, >>               if (!prog) >>                   virtnet_restore_guest_offloads(vi); >>           } >> +    } >> + >> +    if (old_prog && !prog) { >> +        synchronize_net(); >> +        err = _virtnet_set_queues(vi, curr_qp + xdp_qp); >> +        if (err) >> +            goto err_old_prog; >> +        netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp); >> +        vi->xdp_queue_pairs = xdp_qp; >> +    } >> + >> +    for (i = 0; i < vi->max_queue_pairs; i++) { >>           if (old_prog) >>               bpf_prog_put(old_prog); >>           if (netif_running(dev)) { >> @@ -2450,7 +2464,11 @@ static int virtnet_xdp_set(struct net_device >> *dev, struct bpf_prog *prog, >>         return 0; >>   -err: >> +err_old_prog: >> +    virtnet_clear_guest_offloads(vi); >> +    for (i = 0; i < vi->max_queue_pairs; i++) >> +        rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog); >> +err_new_prog: >>       if (netif_running(dev)) { >>           for (i = 0; i < vi->max_queue_pairs; i++) { >>               virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);