On 7/25/24 04:43, Willem de Bruijn wrote:
Jeongjun Park wrote:
In the previous commit, bpf_net_context handling was added to
tun_sendmsg() and do_xdp_generic(), but if you write code like this,
bpf_net_context overlaps in the call trace below, causing various
memory corruptions.
I'm no expert on this code, but commit 401cb7dae813 that introduced
bpf_net_ctx_set explicitly states that nested calls are allowed.
And the function does imply that:
static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
{
struct task_struct *tsk = current;
if (tsk->bpf_net_context != NULL)
return NULL;
bpf_net_ctx->ri.kern_flags = 0;
tsk->bpf_net_context = bpf_net_ctx;
return bpf_net_ctx;
}
I agree with Willem, the ctx nesting looks legit generally speaking.
@Jeongjun: you need to track down more accurately the issue root cause
and include such info into the commit message.
Skimming over the code I *think* do_xdp_generic() is not cleaning the
nested context in all the paths before return and that could cause the
reported issue.
Thanks,
Paolo
