| Message ID | 20240912155620.1334587-1-leitao@debian.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 157f29152b61ca41809dd7ead29f5733adeced19 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] netkit: Assign missing bpf_net_context | expand |
Breno Leitao <leitao@debian.org> writes: > During the introduction of struct bpf_net_context handling for > XDP-redirect, the netkit driver has been missed, which also requires it > because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the > per-CPU variables. Otherwise we see the following crash: > > BUG: kernel NULL pointer dereference, address: 0000000000000038 > bpf_redirect() > netkit_xmit() > dev_hard_start_xmit() > > Set the bpf_net_context before invoking netkit_xmit() program within the > netkit driver. > > Fixes: 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") > Signed-off-by: Breno Leitao <leitao@debian.org> > Acked-by: Daniel Borkmann <daniel@iogearbox.net> > Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
On 9/12/24 18:56, Breno Leitao wrote: > During the introduction of struct bpf_net_context handling for > XDP-redirect, the netkit driver has been missed, which also requires it > because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the > per-CPU variables. Otherwise we see the following crash: > > BUG: kernel NULL pointer dereference, address: 0000000000000038 > bpf_redirect() > netkit_xmit() > dev_hard_start_xmit() > > Set the bpf_net_context before invoking netkit_xmit() program within the > netkit driver. > > Fixes: 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") > Signed-off-by: Breno Leitao <leitao@debian.org> > Acked-by: Daniel Borkmann <daniel@iogearbox.net> > Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> > --- > drivers/net/netkit.c | 3 +++ > 1 file changed, 3 insertions(+) > Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
On 9/12/24 8:56 AM, Breno Leitao wrote: > During the introduction of struct bpf_net_context handling for > XDP-redirect, the netkit driver has been missed, which also requires it > because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the > per-CPU variables. Otherwise we see the following crash: > > BUG: kernel NULL pointer dereference, address: 0000000000000038 > bpf_redirect() > netkit_xmit() > dev_hard_start_xmit() > > Set the bpf_net_context before invoking netkit_xmit() program within the > netkit driver. Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Thu, 12 Sep 2024 08:56:19 -0700 you wrote: > During the introduction of struct bpf_net_context handling for > XDP-redirect, the netkit driver has been missed, which also requires it > because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the > per-CPU variables. Otherwise we see the following crash: > > BUG: kernel NULL pointer dereference, address: 0000000000000038 > bpf_redirect() > netkit_xmit() > dev_hard_start_xmit() > > [...] Here is the summary with links: - [net] netkit: Assign missing bpf_net_context https://git.kernel.org/netdev/net/c/157f29152b61 You are awesome, thank you!
diff --git a/drivers/net/netkit.c b/drivers/net/netkit.c index 16789cd446e9..3f4187102e77 100644 --- a/drivers/net/netkit.c +++ b/drivers/net/netkit.c @@ -65,6 +65,7 @@ static struct netkit *netkit_priv(const struct net_device *dev) static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev) { + struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx; struct netkit *nk = netkit_priv(dev); enum netkit_action ret = READ_ONCE(nk->policy); netdev_tx_t ret_dev = NET_XMIT_SUCCESS; @@ -72,6 +73,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev) struct net_device *peer; int len = skb->len; + bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx); rcu_read_lock(); peer = rcu_dereference(nk->peer); if (unlikely(!peer || !(peer->flags & IFF_UP) || @@ -110,6 +112,7 @@ static netdev_tx_t netkit_xmit(struct sk_buff *skb, struct net_device *dev) break; } rcu_read_unlock(); + bpf_net_ctx_clear(bpf_net_ctx); return ret_dev; }
During the introduction of struct bpf_net_context handling for XDP-redirect, the netkit driver has been missed, which also requires it because NETKIT_REDIRECT invokes skb_do_redirect() which is accessing the per-CPU variables. Otherwise we see the following crash: BUG: kernel NULL pointer dereference, address: 0000000000000038 bpf_redirect() netkit_xmit() dev_hard_start_xmit() Set the bpf_net_context before invoking netkit_xmit() program within the netkit driver. Fixes: 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") Signed-off-by: Breno Leitao <leitao@debian.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> --- drivers/net/netkit.c | 3 +++ 1 file changed, 3 insertions(+)