Commit f3dda7a6 authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Daniel Borkmann

bpf: net: Avoid copying sk_user_data of reuseport_array during sk_clone

It makes little sense for copying sk_user_data of reuseport_array during
sk_clone_lock().  This patch reuses the SK_USER_DATA_NOCOPY bit introduced in
commit f1ff5ce2 ("net, sk_msg: Clear sk_user_data pointer on clone if tagged").
It is used to mark the sk_user_data is not supposed to be copied to its clone.

Although the cloned sk's sk_user_data will not be used/freed in
bpf_sk_reuseport_detach(), this change can still allow the cloned
sk's sk_user_data to be used by some other means.

Freeing the reuseport_array's sk_user_data does not require a rcu grace
period.  Thus, the existing rcu_assign_sk_user_data_nocopy() is not
used.

Fixes: 5dc4c4b7 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY")
Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarJakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20200709061104.4018798-1-kafai@fb.com
parent 365f9ae4
...@@ -20,11 +20,14 @@ static struct reuseport_array *reuseport_array(struct bpf_map *map) ...@@ -20,11 +20,14 @@ static struct reuseport_array *reuseport_array(struct bpf_map *map)
/* The caller must hold the reuseport_lock */ /* The caller must hold the reuseport_lock */
void bpf_sk_reuseport_detach(struct sock *sk) void bpf_sk_reuseport_detach(struct sock *sk)
{ {
struct sock __rcu **socks; uintptr_t sk_user_data;
write_lock_bh(&sk->sk_callback_lock); write_lock_bh(&sk->sk_callback_lock);
socks = sk->sk_user_data; sk_user_data = (uintptr_t)sk->sk_user_data;
if (socks) { if (sk_user_data) {
struct sock __rcu **socks;
socks = (void *)(sk_user_data & SK_USER_DATA_PTRMASK);
WRITE_ONCE(sk->sk_user_data, NULL); WRITE_ONCE(sk->sk_user_data, NULL);
/* /*
* Do not move this NULL assignment outside of * Do not move this NULL assignment outside of
...@@ -252,6 +255,7 @@ int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key, ...@@ -252,6 +255,7 @@ int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key,
struct sock *free_osk = NULL, *osk, *nsk; struct sock *free_osk = NULL, *osk, *nsk;
struct sock_reuseport *reuse; struct sock_reuseport *reuse;
u32 index = *(u32 *)key; u32 index = *(u32 *)key;
uintptr_t sk_user_data;
struct socket *socket; struct socket *socket;
int err, fd; int err, fd;
...@@ -305,7 +309,8 @@ int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key, ...@@ -305,7 +309,8 @@ int bpf_fd_reuseport_array_update_elem(struct bpf_map *map, void *key,
if (err) if (err)
goto put_file_unlock; goto put_file_unlock;
WRITE_ONCE(nsk->sk_user_data, &array->ptrs[index]); sk_user_data = (uintptr_t)&array->ptrs[index] | SK_USER_DATA_NOCOPY;
WRITE_ONCE(nsk->sk_user_data, (void *)sk_user_data);
rcu_assign_pointer(array->ptrs[index], nsk); rcu_assign_pointer(array->ptrs[index], nsk);
free_osk = osk; free_osk = osk;
err = 0; err = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment