From patchwork Fri Aug 17 23:08:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tushar Dave X-Patchwork-Id: 959135 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=oracle.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=oracle.com header.i=@oracle.com header.b="szSSSrtI"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41sf6h55hxz9s7c for ; Sat, 18 Aug 2018 09:09:48 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726215AbeHRCPA (ORCPT ); Fri, 17 Aug 2018 22:15:00 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:41830 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725825AbeHRCO7 (ORCPT ); Fri, 17 Aug 2018 22:14:59 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7HN0LFx031095; Fri, 17 Aug 2018 23:09:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=cxGM3pTWH38VTBd6jda5LJhWfdW1T+llLp7aTFKDAgw=; b=szSSSrtIUM3oJHWGVN/6wwwPdQwO1lzCKds11a9F7TDZa/QWxSW9aqsQ0CV6K+3TcZu6 SC5TIiAdZJ6S4hi0nyxPPXbE85CyWv4EgPxkuo/cUV5BvuyOLEh4zQh+UMSPswo4AsKu TMTSG6m0s4WA3LZez6MO56fSXOoTjsX7TGKwQsd/9CLGyYdK+1X29IQf1TX69diqdCiA GbJN7M/rxN7KPjg3ZGCIV1KOHlr3LeyEzbxjH6/dijNgfy627c6WZxwUvdkbkgdC95Dg 4SfzCycCKD4rjmwYH+jVVsy0iuPKo8URQ2at5bt4el4kc6ua8j+8TzL9KDKUmhjpFcxs pg== Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by aserp2120.oracle.com with ESMTP id 2ksqrpsu08-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 17 Aug 2018 23:09:12 +0000 Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w7HN9B4L008876 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 17 Aug 2018 23:09:11 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id w7HN9Ae2025818; Fri, 17 Aug 2018 23:09:10 GMT Received: from lab71.no.oracle.com (/10.172.144.174) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 17 Aug 2018 16:09:10 -0700 From: Tushar Dave To: john.fastabend@gmail.com, ast@kernel.org, daniel@iogearbox.net, davem@davemloft.net, sowmini.varadhan@oracle.com, santosh.shilimkar@oracle.com, jakub.kicinski@netronome.com, quentin.monnet@netronome.com, jiong.wang@netronome.com, sandipan@linux.vnet.ibm.com, kafai@fb.com, rdna@fb.com, yhs@fb.com, netdev@vger.kernel.org Subject: [RFC v3 net-next 3/5] ebpf: fix bpf_msg_pull_data Date: Sat, 18 Aug 2018 01:08:23 +0200 Message-Id: <1534547305-25140-4-git-send-email-tushar.n.dave@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1534547305-25140-1-git-send-email-tushar.n.dave@oracle.com> References: <1534547305-25140-1-git-send-email-tushar.n.dave@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8988 signatures=668707 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=2 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808170242 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Like sockmap (sk_msg), socksg also deals with struct scatterlist therefore socksg programs can use existing bpf helper bpf_msg_pull_data to access packet data contained in struct scatterlist. While doing some prelimnary testing, there are couple of issues found with bpf_msg_pull_data that are fixed in this patch. Also, there cannot be more than MAX_SKB_FRAGS entries in sg_data therefore any checks for sg entry more than MAX_SKB_FRAGS in bpf_msg_pull_data() is removed. Besides that, I also ran into issues while put_page() is invoked. e.g. [ 450.568723] BUG: Bad page state in process swapper/10 pfn:2021540 [ 450.575632] page:ffffea0080855000 count:0 mapcount:0 mapping:ffff88103d006840 index:0xffff882021540000 compound_mapcount: 0 [ 450.588069] flags: 0x6fffff80008100(slab|head) [ 450.593033] raw: 006fffff80008100 dead000000000100 dead000000000200 ffff88103d006840 [ 450.601683] raw: ffff882021540000 0000000080080007 00000000ffffffff 0000000000000000 [ 450.610337] page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set [ 450.617530] bad because of flags: 0x100(slab) To avoid above issue, currently put_page() is disabled in this patch temporarily. I am working on alternatives so that page allocated via slab (in this case) can be freed without any issue. Signed-off-by: Tushar Dave Acked-by: Sowmini Varadhan --- net/core/filter.c | 61 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 32 insertions(+), 29 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index e427c8e..cc52baa 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2316,7 +2316,7 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) BPF_CALL_4(bpf_msg_pull_data, struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags) { - unsigned int len = 0, offset = 0, copy = 0; + unsigned int len = 0, offset = 0, copy = 0, off = 0; struct scatterlist *sg = msg->sg_data; int first_sg, last_sg, i, shift; unsigned char *p, *to, *from; @@ -2330,22 +2330,28 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) i = msg->sg_start; do { len = sg[i].length; - offset += len; if (start < offset + len) break; + offset += len; i++; - if (i == MAX_SKB_FRAGS) - i = 0; - } while (i != msg->sg_end); + } while (i <= msg->sg_end); + /* return error if start is out of range */ if (unlikely(start >= offset + len)) return -EINVAL; - if (!msg->sg_copy[i] && bytes <= len) - goto out; + /* return error if i is last entry in sglist and end is out of range */ + if (msg->sg_copy[i] && end > offset + len) + return -EINVAL; first_sg = i; + /* if i is not last entry in sg list and end (i.e start + bytes) is + * within this sg[i] then goto out and calculate data and data_end + */ + if (!msg->sg_copy[i] && end <= offset + len) + goto out; + /* At this point we need to linearize multiple scatterlist * elements or a single shared page. Either way we need to * copy into a linear buffer exclusively owned by BPF. Then @@ -2359,11 +2365,14 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) do { copy += sg[i].length; i++; - if (i == MAX_SKB_FRAGS) - i = 0; - if (bytes < copy) + if (end < copy) break; - } while (i != msg->sg_end); + } while (i <= msg->sg_end); + + /* return error if i is last entry in sglist and end is out of range */ + if (i > msg->sg_end && end > offset + copy) + return -EINVAL; + last_sg = i; if (unlikely(copy < end - start)) @@ -2373,23 +2382,25 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) if (unlikely(!page)) return -ENOMEM; p = page_address(page); - offset = 0; i = first_sg; do { from = sg_virt(&sg[i]); len = sg[i].length; - to = p + offset; + to = p + off; memcpy(to, from, len); - offset += len; + off += len; sg[i].length = 0; - put_page(sg_page(&sg[i])); + /* if original page is allocated via slab then put_page + * causes error BUG: Bad page state in process. So temporarily + * disabled put_page. + * Todo: fix it + */ + //put_page(sg_page(&sg[i])); i++; - if (i == MAX_SKB_FRAGS) - i = 0; - } while (i != last_sg); + } while (i < last_sg); sg[first_sg].length = copy; sg_set_page(&sg[first_sg], page, copy, 0); @@ -2406,12 +2417,8 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) do { int move_from; - if (i + shift >= MAX_SKB_FRAGS) - move_from = i + shift - MAX_SKB_FRAGS; - else - move_from = i + shift; - - if (move_from == msg->sg_end) + move_from = i + shift; + if (move_from > msg->sg_end) break; sg[i] = sg[move_from]; @@ -2420,14 +2427,10 @@ struct sock *do_msg_redirect_map(struct sk_msg_buff *msg) sg[move_from].offset = 0; i++; - if (i == MAX_SKB_FRAGS) - i = 0; } while (1); msg->sg_end -= shift; - if (msg->sg_end < 0) - msg->sg_end += MAX_SKB_FRAGS; out: - msg->data = sg_virt(&sg[i]) + start - offset; + msg->data = sg_virt(&sg[first_sg]) + start - offset; msg->data_end = msg->data + bytes; return 0;