All of lore.kernel.org
 help / color / mirror / Atom feed
From: sdf@google.com
To: Lorenz Bauer <oss@lmb.io>
Cc: shaozhengchao <shaozhengchao@huawei.com>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
	yuehaibing@huawei.com
Subject: Re: [PATCH v4,bpf-next] bpf: Don't redirect packets with invalid pkt_len
Date: Fri, 14 Oct 2022 09:55:40 -0700	[thread overview]
Message-ID: <Y0mUjLXEpVuheSUc@google.com> (raw)
In-Reply-To: <04d2eb4a-7365-495a-ab74-704febac2789@app.fastmail.com>

On 10/14, Lorenz Bauer wrote:
> On Thu, 13 Oct 2022, at 11:44, shaozhengchao wrote:
> > 	Sorry, I haven't fully understood your intentions yet.
> > Can you explain it more detail?

> I'll try! Roughly, we do the following:

> 1. Create a BPF_PROG_TYPE_SOCKET_FILTER program that just returns 0
> 2. Load the program into the kernel
> 3. Call BPF_PROG_RUN with data_size_in == 14

> After your bugfix, it seems like step 3 is rejected due to data_size_in  
> == 14. We had to increase data_size_in to 15 to
> avoid this, see [0].

> This breaks user space, so it would be great if you could fix this in a  
> way that doesn't refuse BPF_PROG_RUN with

[..]

> data_size_in == 14. Since I don't understand the original problem very  
> well I can't tell you what the best fix is however.

The problem was that we were able to generate skb with len=0 via
BPF_PROG_RUN. Prohibiting those cases breaks backwards compatibility, so
we either have to:

a) (preferred?) accept inputs with <14, but maybe internally pad to 14
bytes to make the core stack happy
b) revert the patch and instead have length checks at runtime; doesn't seem  
to
be worth the penalty in the forwarding path because of some corner cases
like these ?


> 0:  
> https://github.com/cilium/ebpf/commit/a38fb6b5a46ab3b5639ea4d421232a10013596c0

> Thanks
> Lorenz

  reply	other threads:[~2022-10-14 16:55 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-15 11:55 [PATCH v4,bpf-next] bpf: Don't redirect packets with invalid pkt_len Zhengchao Shao
2022-07-15 23:30 ` Stanislav Fomichev
2022-07-19 17:00 ` patchwork-bot+netdevbpf
2022-09-14 11:19 ` Lorenz Bauer
2022-09-17 15:46   ` Stanislav Fomichev
2022-09-19 10:55     ` shaozhengchao
2022-09-20 14:42       ` Lorenz Bauer
2022-09-21  8:48         ` shaozhengchao
2022-09-21 20:59           ` Stanislav Fomichev
2022-10-13  9:36           ` Lorenz Bauer
2022-10-13 10:44             ` shaozhengchao
2022-10-14 16:29               ` Lorenz Bauer
2022-10-14 16:55                 ` sdf [this message]
2022-10-15  2:36                   ` shaozhengchao
2022-11-03 21:07 ` Martin KaFai Lau
2022-11-03 21:36   ` Stanislav Fomichev
2022-11-03 22:42     ` Martin KaFai Lau
2022-11-03 22:58       ` Stanislav Fomichev
2022-11-09 21:43         ` Stanislav Fomichev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y0mUjLXEpVuheSUc@google.com \
    --to=sdf@google.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oss@lmb.io \
    --cc=shaozhengchao@huawei.com \
    --cc=yuehaibing@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.