From: Stanislav Fomichev <sdf@google.com>
To: "Toke Høiland-Jørgensen" <toke@redhat.com>
Cc: bpf@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net,
andrii@kernel.org, martin.lau@linux.dev, song@kernel.org,
yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org,
haoluo@google.com, jolsa@kernel.org,
David Ahern <dsahern@gmail.com>, Jakub Kicinski <kuba@kernel.org>,
Willem de Bruijn <willemb@google.com>,
Jesper Dangaard Brouer <brouer@redhat.com>,
Anatoly Burakov <anatoly.burakov@intel.com>,
Alexander Lobakin <alexandr.lobakin@intel.com>,
Magnus Karlsson <magnus.karlsson@gmail.com>,
Maryam Tahhan <mtahhan@redhat.com>,
xdp-hints@xdp-project.net, netdev@vger.kernel.org
Subject: [xdp-hints] Re: [PATCH bpf-next v3 00/11] xdp: hints via kfuncs
Date: Wed, 30 Nov 2022 16:32:44 -0800 [thread overview]
Message-ID: <CAKH8qBsJSJoVJGg3j_JxeM_10BRyYTt6kQvbSMWT016jyUOu6w@mail.gmail.com> (raw)
In-Reply-To: <87o7soxd1v.fsf@toke.dk>
On Wed, Nov 30, 2022 at 3:01 PM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>
> Stanislav Fomichev <sdf@google.com> writes:
>
> > On Tue, Nov 29, 2022 at 12:50 PM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
> >>
> >> Stanislav Fomichev <sdf@google.com> writes:
> >>
> >> > Please see the first patch in the series for the overall
> >> > design and use-cases.
> >> >
> >> > Changes since v2:
> >> >
> >> > - Rework bpf_prog_aux->xdp_netdev refcnt (Martin)
> >> >
> >> > Switched to dropping the count early, after loading / verification is
> >> > done. At attach time, the pointer value is used only for comparing
> >> > the actual netdev at attach vs netdev at load.
> >>
> >> So if we're not holding the netdev reference, we'll end up with a BPF
> >> program with hard-coded CALL instructions calling into a module that
> >> could potentially be unloaded while that BPF program is still alive,
> >> right?
> >>
> >> I suppose that since we're checking that the attach iface is the same
> >> that the program should not be able to run after the module is unloaded,
> >> but it still seems a bit iffy. And we should definitely block
> >> BPF_PROG_RUN invocations of programs with a netdev set (but we should do
> >> that anyway).
> >
> > Ugh, good point about BPF_PROG_RUN, seems like it should be blocked
> > regardless of the locking scheme though, right?
> > Since our mlx4/mlx5 changes expect something after the xdp_buff, we
> > can't use those per-netdev programs with our generic
> > bpf_prog_test_run_xdp...
>
> Yup, I think we should just block it for now; maybe it can be enabled
> later if it turns out to be useful (and we find a way to resolve the
> kfuncs for this case).
>
> Also, speaking of things we need to disable, tail calls is another one.
> And for freplace program attachment we need to add a check that the
> target interfaces match as well.
Agreed, thanks!
> >> > (potentially can be a problem if the same slub slot is reused
> >> > for another netdev later on?)
> >>
> >> Yeah, this would be bad as well, obviously. I guess this could happen?
> >
> > Not sure, that's why I'm raising it here to see what others think :-)
> > Seems like this has to be actively exploited to happen? (and it's a
> > privileged operation)
> >
> > Alternatively, we can go back to the original version where the prog
> > holds the device.
> > Matin mentioned in the previous version that if we were to hold a
> > netdev refcnt, we'd have to drop it also from unregister_netdevice.
>
> Yeah; I guess we could keep a list of "bound" XDP programs in struct
> net_device and clear each one on unregister? Also, bear in mind that the
> "unregister" callback is also called when a netdev moves between
> namespaces; which is probably not what we want in this case?
>
> > It feels like beyond that extra dev_put, we'd need to reset our
> > aux->xdp_netdev and/or add some flag or something else to indicate
> > that this bpf program is "orphaned" and can't be attached anywhere
> > anymore (since the device is gone; netdev_run_todo should free the
> > netdev it seems).
>
> You could add a flag, and change the check to:
>
> + if (new_prog->aux->xdp_has_netdev &&
> + new_prog->aux->xdp_netdev != dev) {
> + NL_SET_ERR_MSG(extack, "Cannot attach to a different target device");
> + return -EINVAL;
> + }
>
> That way the check will always fail if xdp_netdev is reset to NULL
> (while keeping the flag) on dereg?
Something like that, yeah. I'll also take a closer look at offload.c
as Martin points out. I should probably leverage it instead of trying
to add more custom handling here..
> > That should address this potential issue with reusing the same addr
> > for another netdev, but is a bit more complicated code-wise.
> > Thoughts?
>
> I'd be in favour of adding this tracking; I worry that we'll end up with
> some very subtle and hard-to-debug bugs if we somehow do end up
> executing the wrong kfuncs...
SG, will try to address soon!
prev parent reply other threads:[~2022-12-01 0:32 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-29 19:34 [xdp-hints] " Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 01/11] bpf: Document XDP RX metadata Stanislav Fomichev
2022-12-02 20:58 ` [xdp-hints] " kernel test robot
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 02/11] bpf: XDP metadata RX kfuncs Stanislav Fomichev
2022-11-30 17:56 ` [xdp-hints] " kernel test robot
2022-11-30 22:49 ` kernel test robot
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 03/11] veth: Introduce veth_xdp_buff wrapper for xdp_buff Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 04/11] veth: Support RX XDP metadata Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 05/11] selftests/bpf: Verify xdp_metadata xdp->af_xdp path Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 06/11] mlx4: Introduce mlx4_xdp_buff wrapper for xdp_buff Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 07/11] mxl4: Support RX XDP metadata Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 08/11] xsk: Add cb area to struct xdp_buff_xsk Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 09/11] mlx5: Introduce mlx5_xdp_buff wrapper for xdp_buff Stanislav Fomichev
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 10/11] mlx5: Support RX XDP metadata Stanislav Fomichev
2022-11-30 5:48 ` [xdp-hints] " kernel test robot
2022-11-30 22:29 ` kernel test robot
2022-12-01 2:42 ` kernel test robot
2022-12-01 13:08 ` kernel test robot
2022-11-29 19:34 ` [xdp-hints] [PATCH bpf-next v3 11/11] selftests/bpf: Simple program to dump XDP RX metadata Stanislav Fomichev
2022-11-29 20:50 ` [xdp-hints] Re: [PATCH bpf-next v3 00/11] xdp: hints via kfuncs Toke Høiland-Jørgensen
2022-11-29 23:41 ` Stanislav Fomichev
2022-11-30 23:01 ` Toke Høiland-Jørgensen
2022-12-01 0:16 ` Martin KaFai Lau
2022-12-01 0:32 ` Stanislav Fomichev
2022-12-01 3:56 ` Jakub Kicinski
2022-12-01 0:32 ` Stanislav Fomichev [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.xdp-project.net/postorius/lists/xdp-hints.xdp-project.net/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAKH8qBsJSJoVJGg3j_JxeM_10BRyYTt6kQvbSMWT016jyUOu6w@mail.gmail.com \
--to=sdf@google.com \
--cc=alexandr.lobakin@intel.com \
--cc=anatoly.burakov@intel.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=dsahern@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=magnus.karlsson@gmail.com \
--cc=martin.lau@linux.dev \
--cc=mtahhan@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=song@kernel.org \
--cc=toke@redhat.com \
--cc=willemb@google.com \
--cc=xdp-hints@xdp-project.net \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox