[net-next] net: Implement fault injection forcing skb reallocation

Message ID	20241002113316.2527669-1-leitao@debian.org (mailing list archive)
State	Superseded
Delegated to:	Netdev Maintainers
Headers	show Received: from mail-ed1-f50.google.com (mail-ed1-f50.google.com [209.85.208.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B477198A1A; Wed, 2 Oct 2024 11:37:43 +0000 (UTC) From: Breno Leitao <leitao@debian.org> To: kuba@kernel.org, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com, Akinobu Mita <akinobu.mita@gmail.com>, Jonathan Corbet <corbet@lwn.net> Cc: horms@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Mina Almasry <almasrymina@google.com>, Pavel Begunkov <asml.silence@gmail.com>, Willem de Bruijn <willemb@google.com>, Alexander Lobakin <aleksander.lobakin@intel.com>, linux-doc@vger.kernel.org (open list:DOCUMENTATION) Subject: [PATCH net-next] net: Implement fault injection forcing skb reallocation Date: Wed, 2 Oct 2024 04:32:54 -0700 Message-ID: <20241002113316.2527669-1-leitao@debian.org> Precedence: bulk MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[net-next] net: Implement fault injection forcing skb reallocation \| expand [net-next] net: Implement fault injection forcing skb reallocation

Context	Check	Description
netdev/series_format	success	Single patches do not need cover letters
netdev/tree_selection	success	Clearly marked for net-next
netdev/ynl	success	Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present	success	Fixes tag not required for -next series
netdev/header_inline	success	No static functions without inline keyword in header files
netdev/build_32bit	success	Errors and warnings before: 48 this patch: 48
netdev/build_tools	success	Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers	success	CCed 9 of 9 maintainers
netdev/build_clang	success	Errors and warnings before: 103 this patch: 103
netdev/verify_signedoff	success	Signed-off-by tag matches author and committer
netdev/deprecated_api	success	None detected
netdev/check_selftest	success	No net selftest shell script
netdev/verify_fixes	success	No Fixes tag
netdev/build_allmodconfig_warn	success	Errors and warnings before: 5043 this patch: 5043
netdev/checkpatch	warning	CHECK: __setup appears un-documented -- check Documentation/admin-guide/kernel-parameters.txt WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
netdev/build_clang_rust	success	No Rust files in patch. Skipping build
netdev/kdoc	success	Errors and warnings before: 58 this patch: 58
netdev/source_inline	success	Was 0 now: 0

diff --git a/Documentation/fault-injection/fault-injection.rst b/Documentation/fault-injection/fault-injection.rst index 70380a2a01b4..2fc71330c761 100644 --- a/Documentation/fault-injection/fault-injection.rst +++ b/Documentation/fault-injection/fault-injection.rst @@ -45,6 +45,23 @@ Available fault injection capabilities ALLOW_ERROR_INJECTION() macro, by setting debugfs entries under /sys/kernel/debug/fail_function. No boot option supported. +- fail_net_force_skb_realloc + + inject skb (socket buffer) reallocation events into the network path. The + primary goal is to identify and prevent issues related to pointer + mismanagement in the network subsystem. By forcing skb reallocation at + strategic points, this feature creates scenarios where existing pointers to + skb headers become invalid. + + When the fault is injected and the reallocation is triggered, these pointers + no longer reference valid memory locations. This deliberate invalidation + helps expose code paths where proper pointer updating is neglected after a + reallocation event. + + By creating these controlled fault scenarios, the system can catch instances + where stale pointers are used, potentially leading to memory corruption or + system instability. + - NVMe fault injection inject NVMe status code and retry flag on devices permitted by setting @@ -219,6 +236,7 @@ use the boot option:: fail_usercopy= fail_make_request= fail_futex= + fail_net_force_skb_realloc= mmc_core.fail_request=<interval>,<probability>,<space>,<times> proc entries diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 39f1d16f3628..d9ee756a64fc 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2681,6 +2681,12 @@ static inline void skb_assert_len(struct sk_buff *skb) #endif /* CONFIG_DEBUG_NET */ } +#if defined(CONFIG_FAIL_SKB_FORCE_REALLOC) +void skb_might_realloc(struct sk_buff *skb); +#else +static inline void skb_might_realloc(struct sk_buff *skb) {} +#endif + /* * Add data to an sk_buff */ @@ -2781,6 +2787,7 @@ static inline enum skb_drop_reason pskb_may_pull_reason(struct sk_buff *skb, unsigned int len) { DEBUG_NET_WARN_ON_ONCE(len > INT_MAX); + skb_might_realloc(skb); if (likely(len <= skb_headlen(skb))) return SKB_NOT_DROPPED_YET; @@ -3210,6 +3217,7 @@ static inline int __pskb_trim(struct sk_buff *skb, unsigned int len) static inline int pskb_trim(struct sk_buff *skb, unsigned int len) { + skb_might_realloc(skb); return (len < skb->len) ? __pskb_trim(skb, len) : 0; } @@ -3964,6 +3972,7 @@ int pskb_trim_rcsum_slow(struct sk_buff *skb, unsigned int len); static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) { + skb_might_realloc(skb); if (likely(len >= skb->len)) return 0; return pskb_trim_rcsum_slow(skb, len); diff --git a/net/Kconfig.debug b/net/Kconfig.debug index 5e3fffe707dd..f61935e028bd 100644 --- a/net/Kconfig.debug +++ b/net/Kconfig.debug @@ -24,3 +24,14 @@ config DEBUG_NET help Enable extra sanity checks in networking. This is mostly used by fuzzers, but is safe to select. + +config FAIL_SKB_FORCE_REALLOC + bool "Fault-injection capability forcing skb to reallocate" + depends on FAULT_INJECTION && DEBUG_NET + default n + help + Provide fault-injection capability that forces the skb to be + reallocated, caughting possible invalid pointers to the skb. + + For more information, check + Documentation/dev-tools/fault-injection/fault-injection.rst diff --git a/net/core/Makefile b/net/core/Makefile index c3ebbaf9c81e..02658807242b 100644 --- a/net/core/Makefile +++ b/net/core/Makefile @@ -45,3 +45,4 @@ obj-$(CONFIG_BPF_SYSCALL) += bpf_sk_storage.o obj-$(CONFIG_OF) += of_net.o obj-$(CONFIG_NET_TEST) += net_test.o obj-$(CONFIG_NET_DEVMEM) += devmem.o +obj-$(CONFIG_FAIL_SKB_FORCE_REALLOC) += skb_fault_injection.o diff --git a/net/core/skb_fault_injection.c b/net/core/skb_fault_injection.c new file mode 100644 index 000000000000..ccdc0f9c41be --- /dev/null +++ b/net/core/skb_fault_injection.c @@ -0,0 +1,33 @@ +// SPDX-License-Identifier: GPL-2.0-only + +#include <linux/fault-inject.h> +#include <linux/skbuff.h> + +static DECLARE_FAULT_ATTR(fail_net_force_skb_realloc); + +void skb_might_realloc(struct sk_buff *skb) +{ + if (should_fail(&fail_net_force_skb_realloc, 1)) + pskb_expand_head(skb, 0, 0, GFP_ATOMIC); +} +EXPORT_SYMBOL(skb_might_realloc); + +static int __init fail_net_force_skb_realloc_setup(char *str) +{ + return setup_fault_attr(&fail_net_force_skb_realloc, str); +} +__setup("fail_net_force_skb_realloc=", fail_net_force_skb_realloc_setup); + +static int __init fail_net_force_skb_realloc_debugfs(void) +{ + struct dentry *dir; + + dir = fault_create_debugfs_attr("fail_net_force_skb_realloc", NULL, + &fail_net_force_skb_realloc); + if (IS_ERR(dir)) + return PTR_ERR(dir); + + return 0; +} + +late_initcall(fail_net_force_skb_realloc_debugfs);

[net-next] net: Implement fault injection forcing skb reallocation

Checks

Commit Message

Comments

Patch