netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jakub Sitnicki <jakub@cloudflare.com>,
	Alexei Starovoitov <ast@kernel.org>,
	Stanislav Fomichev <sdf@google.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	netdev@vger.kernel.org, bpf@vger.kernel.org
Subject: [PATCH AUTOSEL 5.6 198/606] flow_dissector: Drop BPF flow dissector prog ref on netns cleanup
Date: Mon,  8 Jun 2020 19:05:23 -0400	[thread overview]
Message-ID: <20200608231211.3363633-198-sashal@kernel.org> (raw)
In-Reply-To: <20200608231211.3363633-1-sashal@kernel.org>

From: Jakub Sitnicki <jakub@cloudflare.com>

commit 5cf65922bb15279402e1e19b5ee8c51d618fa51f upstream.

When attaching a flow dissector program to a network namespace with
bpf(BPF_PROG_ATTACH, ...) we grab a reference to bpf_prog.

If netns gets destroyed while a flow dissector is still attached, and there
are no other references to the prog, we leak the reference and the program
remains loaded.

Leak can be reproduced by running flow dissector tests from selftests/bpf:

  # bpftool prog list
  # ./test_flow_dissector.sh
  ...
  selftests: test_flow_dissector [PASS]
  # bpftool prog list
  4: flow_dissector  name _dissect  tag e314084d332a5338  gpl
          loaded_at 2020-05-20T18:50:53+0200  uid 0
          xlated 552B  jited 355B  memlock 4096B  map_ids 3,4
          btf_id 4
  #

Fix it by detaching the flow dissector program when netns is going away.

Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20200521083435.560256-1-jakub@cloudflare.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/flow_dissector.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index a1670dff0629..0e5012d7b7b5 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -160,12 +160,10 @@ int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr,
 	return ret;
 }
 
-int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
+static int flow_dissector_bpf_prog_detach(struct net *net)
 {
 	struct bpf_prog *attached;
-	struct net *net;
 
-	net = current->nsproxy->net_ns;
 	mutex_lock(&flow_dissector_mutex);
 	attached = rcu_dereference_protected(net->flow_dissector_prog,
 					     lockdep_is_held(&flow_dissector_mutex));
@@ -179,6 +177,24 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
 	return 0;
 }
 
+int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
+{
+	return flow_dissector_bpf_prog_detach(current->nsproxy->net_ns);
+}
+
+static void __net_exit flow_dissector_pernet_pre_exit(struct net *net)
+{
+	/* We're not racing with attach/detach because there are no
+	 * references to netns left when pre_exit gets called.
+	 */
+	if (rcu_access_pointer(net->flow_dissector_prog))
+		flow_dissector_bpf_prog_detach(net);
+}
+
+static struct pernet_operations flow_dissector_pernet_ops __net_initdata = {
+	.pre_exit = flow_dissector_pernet_pre_exit,
+};
+
 /**
  * __skb_flow_get_ports - extract the upper layer ports and return them
  * @skb: sk_buff to extract the ports from
@@ -1838,7 +1854,7 @@ static int __init init_default_flow_dissectors(void)
 	skb_flow_dissector_init(&flow_keys_basic_dissector,
 				flow_keys_basic_dissector_keys,
 				ARRAY_SIZE(flow_keys_basic_dissector_keys));
-	return 0;
-}
 
+	return register_pernet_subsys(&flow_dissector_pernet_ops);
+}
 core_initcall(init_default_flow_dissectors);
-- 
2.25.1


  parent reply	other threads:[~2020-06-09  0:29 UTC|newest]

Thread overview: 70+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20200608231211.3363633-1-sashal@kernel.org>
2020-06-08 23:02 ` [PATCH AUTOSEL 5.6 006/606] bpf: Fix bug in mmap() implementation for BPF array map Sasha Levin
2020-06-08 23:02 ` [PATCH AUTOSEL 5.6 009/606] net/rds: Use ERR_PTR for rds_message_alloc_sgs() Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 067/606] SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()") Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 068/606] bpf: Fix sk_psock refcnt leak when receiving message Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 075/606] bpf: Enforce returning 0 for fentry/fexit progs Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 076/606] selftests/bpf: Enforce returning 0 for fentry/fexit programs Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 077/606] bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 102/606] net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 111/606] vhost/vsock: fix packet delivery order to monitoring devices Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 112/606] aquantia: Fix the media type of AQC100 ethernet controller in the driver Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 114/606] net/ena: Fix build warning in ena_xdp_set() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 117/606] ibmvnic: Skip fatal error reset after passive init Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 121/606] gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 124/606] stmmac: fix pointer check after utilization in stmmac_interrupt Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 141/606] bpf: Restrict bpf_probe_read{, str}() only to archs where they work Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 142/606] bpf: Add bpf_probe_read_{user, kernel}_str() to do_refine_retval_range Sasha Levin
2020-06-08 23:04 ` [PATCH AUTOSEL 5.6 168/606] kbuild: Remove debug info from kallsyms linking Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 194/606] rxrpc: Fix the excessive initial retransmission timeout Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 195/606] rxrpc: Fix a memory leak in rxkad_verify_response() Sasha Levin
2020-06-08 23:05 ` Sasha Levin [this message]
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 200/606] rxrpc: Trace discarded ACKs Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 201/606] rxrpc: Fix ack discard Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 202/606] bpf: Prevent mmap()'ing read-only maps as writable Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 207/606] ax25: fix setsockopt(SO_BINDTODEVICE) Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 208/606] dpaa_eth: fix usage as DSA master, try 3 Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 209/606] ethtool: count header size in reply size estimate Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 210/606] felix: Fix initialization of ioremap resources Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 211/606] net: don't return invalid table id error when we fall back to PF_UNSPEC Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 212/606] net: dsa: mt7530: fix roaming from DSA user ports Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 213/606] net: ethernet: ti: cpsw: fix ASSERT_RTNL() warning during suspend Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 214/606] __netif_receive_skb_core: pass skb by reference Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 215/606] net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 216/606] net: ipip: fix wrong address family in init error path Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 217/606] net/mlx5: Add command entry handling completion Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 218/606] net: mvpp2: fix RX hashing for non-10G ports Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 219/606] net: nlmsg_cancel() if put fails for nhmsg Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 220/606] net: qrtr: Fix passing invalid reference to qrtr_local_enqueue() Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 221/606] net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 222/606] net sched: fix reporting the first-time use timestamp Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 223/606] net/tls: fix race condition causing kernel panic Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 224/606] nexthop: Fix attribute checking for groups Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 225/606] r8152: support additional Microsoft Surface Ethernet Adapter variant Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 226/606] sctp: Don't add the shutdown timer if its already been added Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 227/606] sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 228/606] tipc: block BH before using dst_cache Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 229/606] net/mlx5e: kTLS, Destroy key object after destroying the TIS Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 230/606] net/mlx5e: Fix inner tirs handling Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 231/606] net/mlx5: Fix memory leak in mlx5_events_init Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 232/606] net/mlx5e: Update netdev txq on completions during closure Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 233/606] net/mlx5: Fix error flow in case of function_setup failure Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 234/606] wireguard: noise: read preshared key while taking lock Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 235/606] wireguard: queueing: preserve flow hash across packet scrubbing Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 236/606] wireguard: noise: separate receive counter from send counter Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 237/606] r8169: fix OCP access on RTL8117 Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 238/606] net/mlx5: Fix a race when moving command interface to events mode Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 239/606] net/mlx5: Fix cleaning unmanaged flow tables Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 241/606] net/mlx5: Avoid processing commands before cmdif is ready Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 242/606] net/mlx5: Annotate mutex destroy for root ns Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 243/606] net/tls: fix encryption error checking Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 244/606] net/tls: free record only on encryption error Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 245/606] net: sun: fix missing release regions in cas_init_one() Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 246/606] net/mlx4_core: fix a memory leak bug Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 247/606] net: sgi: ioc3-eth: Fix return value check in ioc3eth_probe() Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 248/606] mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 249/606] net: mscc: ocelot: fix address ageing time (again) Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 261/606] net: microchip: encx24j600: add missed kthread_stop Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 272/606] net: freescale: select CONFIG_FIXED_PHY where needed Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 287/606] samples: bpf: Fix build error Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 288/606] drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c Sasha Levin
2020-06-08 23:07 ` [PATCH AUTOSEL 5.6 325/606] libceph: ignore pool overlay and cache logic on redirects Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200608231211.3363633-198-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=jakub@cloudflare.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=sdf@google.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).