[PATCH] tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function
From: Liu Jian <hidden>
Date: 2021-09-29 08:45:25
Also in:
bpf
Subsystem:
bpf [l7 framework] (sockmap), networking [general], networking [tcp], the rest · Maintainers:
John Fastabend, Jakub Sitnicki, Jiayuan Chen, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Neal Cardwell, Linus Torvalds
In the following cases: We need to redirect the first msg to sock1 and the second msg to sock2. The sock lock needs to be released at __SK_REDIRECT and to get another sock lock, this will cause the probability that psock->eval is not set to __SK_NONE when the second msg comes. If psock does not set apple bytes, fix this by do the cleanup before releasing the sock lock. And keep the original logic in other cases. Signed-off-by: Liu Jian <redacted> --- net/ipv4/tcp_bpf.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index d3e9386b493e..02442e43ac4d 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c@@ -232,6 +232,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, bool cork = false, enospc = sk_msg_full(msg); struct sock *sk_redir; u32 tosend, delta = 0; + u32 eval = __SK_NONE; int ret; more_data:
@@ -274,6 +275,12 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, break; case __SK_REDIRECT: sk_redir = psock->sk_redir; + if (!psock->apply_bytes) { + /* Clean up before releasing the sock lock. */ + eval = psock->eval; + psock->eval = __SK_NONE; + psock->sk_redir = NULL; + } sk_msg_apply_bytes(psock, tosend); if (psock->cork) { cork = true;
@@ -281,7 +288,12 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, } sk_msg_return(sk, msg, tosend); release_sock(sk); + ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); + + if (eval == __SK_REDIRECT) + sock_put(sk_redir); + lock_sock(sk); if (unlikely(ret < 0)) { int free = sk_msg_free_nocharge(sk, msg);
--
2.17.1