From patchwork Mon Nov 18 03:09:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiayuan Chen X-Patchwork-Id: 13878048 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.2]) by smtp.subspace.kernel.org (Postfix) with ESMTP id E8BE9139D; Mon, 18 Nov 2024 03:10:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731899444; cv=none; b=rZv7y3oIJUBTFMrB41BaX73GRvgVi8JKLqowWkYd4ywb2GAMDwRt8bN8plFjaF3M+E4rogUWG0LpVLckDFfaekyw03DNx5oOElq2UWcrIX2U5ZlzFS4Bj8M8NSgRfF4GUw0U3pmIP9V+ldnDCxhbIYLF2tziJBx8f0o9V03w2Y8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731899444; c=relaxed/simple; bh=s/HE862Ebjc4x9QSbLryT2tjzrtXi+x51IAifw3w0tQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gLw7P0NaSkoizdVw4qUBoXX/95wE8bVBJirbRxClk/J6PwKFrZbojswjJx5Q3e1whC87DBuFw0Cby1WbFea0wg2Z3X/OGvEz919eRuTOMwcm0NUSAKVTm1oFtuAhsyPWM7hEBibLganCO9+zD2rIsasws9LNTWHEsWmdy2UzVrQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=O8x9f828; arc=none smtp.client-ip=117.135.210.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="O8x9f828" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-ID:MIME-Version; bh=0mQMe EqbIH1W/gwL+X7sQKXQSByBBidMVZJPmvHc5LI=; b=O8x9f828FIf+pdv0PSFbN s8pEPtPhcfMbA51V1bFjHNef+ia4TnUEtja5wognArgPz3J1woE4HTKRBg+G2c+I ZkpdHrdt1GIi6/Nixe3OM/Bm1ROEk9mL3NKe2rQHpxzFfvzZQmUjuyiRmLeaavzZ qai+/Lfot0YZ38+y4QvPgI= Received: from localhost.localdomain (unknown [47.252.33.72]) by gzga-smtp-mtada-g0-1 (Coremail) with SMTP id _____wDnTyXirzpnA_TwCQ--.780S3; Mon, 18 Nov 2024 11:09:50 +0800 (CST) From: Jiayuan Chen To: martin.lau@linux.dev, edumazet@google.com, jakub@cloudflare.com, davem@davemloft.net, dsahern@kernel.org, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, horms@kernel.org, daniel@iogearbox.net Cc: mykolal@fb.com, ast@kernel.org, kpsingh@kernel.org, jolsa@kernel.org, eddyz87@gmail.com, shuah@kernel.org, sdf@fomichev.me, linux-kselftest@vger.kernel.org, haoluo@google.com, song@kernel.org, john.fastabend@gmail.com, andrii@kernel.org, mhal@rbox.co, yonghong.song@linux.dev, Jiayuan Chen , Vincent Whitchurch Subject: [PATCH bpf v4 1/2] bpf: fix recursive lock when verdict program return SK_PASS Date: Mon, 18 Nov 2024 11:09:09 +0800 Message-ID: <20241118030910.36230-2-mrpre@163.com> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20241118030910.36230-1-mrpre@163.com> References: <20241118030910.36230-1-mrpre@163.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDnTyXirzpnA_TwCQ--.780S3 X-Coremail-Antispam: 1Uf129KBjvJXoW7KrWkAr1DXF4Duw48JF4fKrg_yoW8Aw1Dpa 4ku3y5GF9rZr18Z3s3KF97Xr1jgw1vgay2gr1ruw1fZrn0gry5urZ5KFy2vF4YvrsrKF98 Zr4jqFsrtw17XaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0z_WrX_UUUUU= X-CM-SenderInfo: xpus2vi6rwjhhfrp/1tbiWwWbp2c6rkc3iAAAsp When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9. ''' sk_psock_strp_data_ready write_lock_bh(&sk->sk_callback_lock) strp_data_ready strp_read_sock read_sock -> tcp_read_sock strp_recv cb.rcv_msg -> sk_psock_strp_read # now stream_verdict return SK_PASS without peer sock assign __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) sk_psock_verdict_apply sk_psock_skb_ingress_self sk_psock_skb_ingress_enqueue sk_psock_data_ready read_lock_bh(&sk->sk_callback_lock) <= dead lock ''' This topic has been discussed before, but it has not been fixed. Previous discussion: https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch Fixes: 6648e613226e ("bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue") Reported-by: Vincent Whitchurch Signed-off-by: Jiayuan Chen Signed-off-by: John Fastabend --- net/core/skmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index b1dcbd3be89e..e90fbab703b2 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -1117,9 +1117,9 @@ static void sk_psock_strp_data_ready(struct sock *sk) if (tls_sw_has_ctx_rx(sk)) { psock->saved_data_ready(sk); } else { - write_lock_bh(&sk->sk_callback_lock); + read_lock_bh(&sk->sk_callback_lock); strp_data_ready(&psock->strp); - write_unlock_bh(&sk->sk_callback_lock); + read_unlock_bh(&sk->sk_callback_lock); } } rcu_read_unlock(); From patchwork Mon Nov 18 03:09:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiayuan Chen X-Patchwork-Id: 13878050 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.3]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 6AFA53BBF2; Mon, 18 Nov 2024 03:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731899466; cv=none; b=ikXYNdK7YcHWVdcq4GIQD+lJZGdXDhxfeCFP27HsIrluSa8MKp3vH+aMUiaNrV/D3GQ38PICO//wE1BBNovgnBcpOttIxXOEQtKNL3Kwnkn5hXrItDBSAnL+KYoOdrtNhyFFAZ1T2S53yAozaXudDQaxzHzVNm3OtYxRWdhW5oU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731899466; c=relaxed/simple; bh=m1Bf8pTAXZVAmctcbTeIv1DRTTkwBXvgdiGG7t0IUt0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TnehGfQ1xQWRInq2jULFam4Ek4fv0pkY2vIUqC4MMt99gYqepldKS+PT+Qpz7vkpQSWPigOkSn9eH/hmtlaaO01X+qqHTLrVA+nQCI2EdNNvqgK3JApKEHoTn+Ng8sWYWdz5SGe38cNXQYlsW1js4Hkf/6AEqsCTwYLos+nObCM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=QmA5W5u8; arc=none smtp.client-ip=117.135.210.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="QmA5W5u8" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-ID:MIME-Version; bh=DvEpP j+D0VN2cgQ0y1KaqjfX8SObfBeJKjuhl+zvTNM=; b=QmA5W5u8bkbfqnKWVBzpK Kivjt5RN9meZxvr3xcC7q6k636mcuDwSKmxCBNGN/JRoyv7FN9d/4HpnlwgYjVy0 +O6wvbBbV5Mly9YyKKaTUW5yRtyS2Kb82rF0hgZMWWs39Dwvt8LWUgOh683STZTm PAV9kwhkkBKwXTztHgKbGw= Received: from localhost.localdomain (unknown [47.252.33.72]) by gzga-smtp-mtada-g0-1 (Coremail) with SMTP id _____wDnTyXirzpnA_TwCQ--.780S4; Mon, 18 Nov 2024 11:10:01 +0800 (CST) From: Jiayuan Chen To: martin.lau@linux.dev, edumazet@google.com, jakub@cloudflare.com, davem@davemloft.net, dsahern@kernel.org, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, horms@kernel.org, daniel@iogearbox.net Cc: mykolal@fb.com, ast@kernel.org, kpsingh@kernel.org, jolsa@kernel.org, eddyz87@gmail.com, shuah@kernel.org, sdf@fomichev.me, linux-kselftest@vger.kernel.org, haoluo@google.com, song@kernel.org, john.fastabend@gmail.com, andrii@kernel.org, mhal@rbox.co, yonghong.song@linux.dev, Jiayuan Chen Subject: [PATCH bpf v4 2/2] selftests/bpf: Add some tests with sockmap SK_PASS Date: Mon, 18 Nov 2024 11:09:10 +0800 Message-ID: <20241118030910.36230-3-mrpre@163.com> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20241118030910.36230-1-mrpre@163.com> References: <20241118030910.36230-1-mrpre@163.com> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: _____wDnTyXirzpnA_TwCQ--.780S4 X-Coremail-Antispam: 1Uf129KBjvJXoWxGr4DJrWkXFyDJr4rAr47Arb_yoW5WFW5pa 4kC34YkFs3Aa42qrs8Gw1I9Fy5WF4rZ3y5KF4jg345CrnrWr1fur1xKayYyr1fGrZaq3W8 uw13uayfG34UJFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0ziyrWrUUUUU= X-CM-SenderInfo: xpus2vi6rwjhhfrp/1tbiDwibp2c6rMNqYAAAsD Add a new tests in sockmap_basic.c to test SK_PASS for sockmap Signed-off-by: Jiayuan Chen --- .../selftests/bpf/prog_tests/sockmap_basic.c | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c index 82bfb266741c..a2041f8e32eb 100644 --- a/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c @@ -501,6 +501,58 @@ static void test_sockmap_skb_verdict_shutdown(void) test_sockmap_pass_prog__destroy(skel); } +static void test_sockmap_stream_pass(void) +{ + int zero = 0, sent, recvd; + int verdict, parser; + int err, map; + int c = -1, p = -1; + struct test_sockmap_pass_prog *pass = NULL; + char snd[256] = "0123456789"; + char rcv[256] = "0"; + + pass = test_sockmap_pass_prog__open_and_load(); + verdict = bpf_program__fd(pass->progs.prog_skb_verdict); + parser = bpf_program__fd(pass->progs.prog_skb_parser); + map = bpf_map__fd(pass->maps.sock_map_rx); + + err = bpf_prog_attach(parser, map, BPF_SK_SKB_STREAM_PARSER, 0); + if (!ASSERT_OK(err, "bpf_prog_attach stream parser")) + goto out; + + err = bpf_prog_attach(verdict, map, BPF_SK_SKB_STREAM_VERDICT, 0); + if (!ASSERT_OK(err, "bpf_prog_attach stream verdict")) + goto out; + + err = create_pair(AF_INET, SOCK_STREAM, &c, &p); + if (err) + goto out; + + /* sk_data_ready of 'p' will be replaced by strparser handler */ + err = bpf_map_update_elem(map, &zero, &p, BPF_NOEXIST); + if (!ASSERT_OK(err, "bpf_map_update_elem(p)")) + goto out_close; + + /* + * as 'prog_skb_parser' return the original skb len and + * 'prog_skb_verdict' return SK_PASS, the kernel will just + * pass it through to original socket 'p' + */ + sent = xsend(c, snd, sizeof(snd), 0); + ASSERT_EQ(sent, sizeof(snd), "xsend(c)"); + + recvd = recv_timeout(p, rcv, sizeof(rcv), SOCK_NONBLOCK, + IO_TIMEOUT_SEC); + ASSERT_EQ(recvd, sizeof(rcv), "recv_timeout(p)"); + +out_close: + close(c); + close(p); + +out: + test_sockmap_pass_prog__destroy(pass); +} + static void test_sockmap_skb_verdict_fionread(bool pass_prog) { int err, map, verdict, c0 = -1, c1 = -1, p0 = -1, p1 = -1; @@ -923,6 +975,8 @@ void test_sockmap_basic(void) test_sockmap_progs_query(BPF_SK_SKB_VERDICT); if (test__start_subtest("sockmap skb_verdict shutdown")) test_sockmap_skb_verdict_shutdown(); + if (test__start_subtest("sockmap stream parser and verdict pass")) + test_sockmap_stream_pass(); if (test__start_subtest("sockmap skb_verdict fionread")) test_sockmap_skb_verdict_fionread(true); if (test__start_subtest("sockmap skb_verdict fionread on drop"))