leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xdp: implement xdp_redirect_map for generic XDP

Browse Source 
Using bpf_redirect_map is allowed for generic XDP programs, but the
appropriate map lookup was never performed in xdp_do_generic_redirect().

Instead the map-index is directly used as the ifindex.  For the
xdp_redirect_map sample in SKB-mode '-S', this resulted in trying
sending on ifindex 0 which isn't valid, resulting in getting SKB
packets dropped.  Thus, the reported performance numbers are wrong in
commit 24251c2647 ("samples/bpf: add option for native and skb mode
for redirect apps") for the 'xdp_redirect_map -S' case.

Before commit 109980b894 ("bpf: don't select potentially stale
ri->map from buggy xdp progs") it could crash the kernel.  Like this
commit also check that the map_owner owner is correct before
dereferencing the map pointer.  But make sure that this API misusage
can be caught by a tracepoint. Thus, allowing userspace via
tracepoints to detect misbehaving bpf_progs.

Fixes: 6103aa96ec ("net: implement XDP_REDIRECT for xdp generic")
Fixes: 24251c2647 ("samples/bpf: add option for native and skb mode for redirect apps")
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jesper Dangaard Brouer
2017-09-10 09:47:02 +02:00
committed by David S. Miller
parent 609320c8a2
commit 96c5508e30
2 changed files with 28 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/trace/events/xdp.h
View File

@@ -138,11 +138,11 @@ DEFINE_EVENT_PRINT(xdp_redirect_template, xdp_redirect_map_err,
#define _trace_xdp_redirect_map(dev, xdp, fwd, map, idx) \ #define _trace_xdp_redirect_map(dev, xdp, fwd, map, idx) \
trace_xdp_redirect_map(dev, xdp, fwd ? fwd->ifindex : 0, \ trace_xdp_redirect_map(dev, xdp, fwd ? fwd->ifindex : 0, \
0, map, idx); 0, map, idx)
#define _trace_xdp_redirect_map_err(dev, xdp, fwd, map, idx, err) \ #define _trace_xdp_redirect_map_err(dev, xdp, fwd, map, idx, err) \
trace_xdp_redirect_map_err(dev, xdp, fwd ? fwd->ifindex : 0, \ trace_xdp_redirect_map_err(dev, xdp, fwd ? fwd->ifindex : 0, \
err, map, idx); err, map, idx)
#endif /* _TRACE_XDP_H */ #endif /* _TRACE_XDP_H */

38
net/core/filter.c
View File

@@ -2506,21 +2506,19 @@ static int xdp_do_redirect_map(struct net_device *dev, struct xdp_buff *xdp,
struct redirect_info *ri = this_cpu_ptr(&redirect_info); struct redirect_info *ri = this_cpu_ptr(&redirect_info);
const struct bpf_prog *map_owner = ri->map_owner; const struct bpf_prog *map_owner = ri->map_owner;
struct bpf_map *map = ri->map; struct bpf_map *map = ri->map;
struct net_device *fwd = NULL;
u32 index = ri->ifindex; u32 index = ri->ifindex;
struct net_device *fwd;
int err; int err;
ri->ifindex = 0; ri->ifindex = 0;
ri->map = NULL; ri->map = NULL;
ri->map_owner = NULL; ri->map_owner = NULL;
/* This is really only caused by a deliberately crappy if (unlikely(map_owner != xdp_prog)) {
* BPF program, normally we would never hit that case, err = -EFAULT;
* so no need to inform someone via tracepoints either, map = NULL;
* just bail out. goto err;
*/ }
if (unlikely(map_owner != xdp_prog))
return -EINVAL;
fwd = __dev_map_lookup_elem(map, index); fwd = __dev_map_lookup_elem(map, index);
if (!fwd) { if (!fwd) {
@@ -2576,13 +2574,27 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
struct bpf_prog *xdp_prog) struct bpf_prog *xdp_prog)
{ {
struct redirect_info *ri = this_cpu_ptr(&redirect_info); struct redirect_info *ri = this_cpu_ptr(&redirect_info);
const struct bpf_prog *map_owner = ri->map_owner;
struct bpf_map *map = ri->map;
struct net_device *fwd = NULL;
u32 index = ri->ifindex; u32 index = ri->ifindex;
struct net_device *fwd;
unsigned int len; unsigned int len;
int err = 0; int err = 0;
fwd = dev_get_by_index_rcu(dev_net(dev), index);
ri->ifindex = 0; ri->ifindex = 0;
ri->map = NULL;
ri->map_owner = NULL;
if (map) {
if (unlikely(map_owner != xdp_prog)) {
err = -EFAULT;
map = NULL;
goto err;
}
fwd = __dev_map_lookup_elem(map, index);
} else {
fwd = dev_get_by_index_rcu(dev_net(dev), index);
}
if (unlikely(!fwd)) { if (unlikely(!fwd)) {
err = -EINVAL; err = -EINVAL;
goto err; goto err;
@@ -2600,10 +2612,12 @@ int xdp_do_generic_redirect(struct net_device *dev, struct sk_buff *skb,
} }
skb->dev = fwd; skb->dev = fwd;
_trace_xdp_redirect(dev, xdp_prog, index); map ? _trace_xdp_redirect_map(dev, xdp_prog, fwd, map, index)
: _trace_xdp_redirect(dev, xdp_prog, index);
return 0; return 0;
err: err:
_trace_xdp_redirect_err(dev, xdp_prog, index, err); map ? _trace_xdp_redirect_map_err(dev, xdp_prog, fwd, map, index, err)
: _trace_xdp_redirect_err(dev, xdp_prog, index, err);
return err; return err;
} }
EXPORT_SYMBOL_GPL(xdp_do_generic_redirect); EXPORT_SYMBOL_GPL(xdp_do_generic_redirect);