bpf, sockmap: Fix psock incorrectly pointing to sk #8991
Conversation
|
Upstream branch: 8259eb0 |
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
b8dcdbb to
e85324d
Compare
|
Upstream branch: bfccacd |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
f33ff92 to
9af4be6
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
e85324d to
61c8df2
Compare
|
Upstream branch: 079e5c5 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
9af4be6 to
29600fd
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
61c8df2 to
708d4b4
Compare
|
Upstream branch: db22b13 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
29600fd to
239414e
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
708d4b4 to
6c5a4cd
Compare
|
Upstream branch: 1ae7a84 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
239414e to
80632ce
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
6c5a4cd to
1918227
Compare
|
Upstream branch: 86bc9c7 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
80632ce to
5c27fc1
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
1918227 to
3777056
Compare
|
Upstream branch: d496557 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
5c27fc1 to
9802a76
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
3777056 to
7f76eaa
Compare
|
Upstream branch: ca56fbd |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
9802a76 to
01d08b2
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
7f76eaa to
5ab4b7b
Compare
|
Upstream branch: 5ffb537 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
01d08b2 to
283124a
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
5ab4b7b to
21880e2
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
54aa8a3 to
daa082a
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
86d7ac4 to
9fa5029
Compare
|
Upstream branch: 90b83ef |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
daa082a to
73dde73
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
9fa5029 to
148f936
Compare
|
Upstream branch: bb1556e |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
73dde73 to
9f060d8
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
148f936 to
b3eed83
Compare
|
Upstream branch: bb1556e |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
9f060d8 to
ccc72d3
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
b3eed83 to
5fa9e7d
Compare
|
Upstream branch: cd2e103 |
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
ccc72d3 to
43ab801
Compare
kernel-patches-daemon-bpf
bot
force-pushed
the
bpf-next_base
branch
from
5fa9e7d to
810d3c3
Compare
|
Upstream branch: cd2e103 |
We observed an issue from the latest selftest: sockmap_redir where
sk_psock(psock->sk) != psock in the backlog. The root cause is the special
behavior in sockmap_redir - it frequently performs map_update() and
map_delete() on the same socket. During map_update(), we create a new
psock and during map_delete(), we eventually free the psock via rcu_work
in sk_psock_drop(). However, pending workqueues might still exist and not
be processed yet. If users immediately perform another map_update(), a new
psock will be allocated for the same sk, resulting in two psocks pointing
to the same sk.
When the pending workqueue is later triggered, it uses the old psock to
access sk for I/O operations, which is incorrect.
Timing Diagram:
cpu0 cpu1
map_update(sk):
sk->psock = psock1
psock1->sk = sk
map_delete(sk):
rcu_work_free(psock1)
map_update(sk):
sk->psock = psock2
psock2->sk = sk
workqueue:
wakeup with psock1, but the sk of psock1
doesn't belong to psock1
rcu_handler:
clean psock1
free(psock1)
Previously, we used reference counting to address the concurrency issue
between backlog and sock_map_close(). This logic remains necessary as it
prevents the sk from being freed while processing the backlog. But this
patch prevents pending backlogs from using a psock after it has been
freed.
Note: We cannot call cancel_delayed_work_sync() in map_delete() since this
might be invoked in BPF context by BPF helper, and the function may sleep.
Fixes: 604326b ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Jiayuan Chen <[email protected]>
kernel-patches-daemon-bpf
bot
force-pushed
the
series/965935=>bpf-next
branch
from
43ab801 to
6e04d3f
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=965935 expired. Closing PR. |
Pull request for series with
subject: bpf, sockmap: Fix psock incorrectly pointing to sk
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=965935