Commit 4fcfdfb8 authored Apr 23, 2018 by John Fastabend Committed by Daniel Borkmann Apr 24, 2018

bpf: sockmap, fix double page_put on ENOMEM error in redirect path

In the case where the socket memory boundary is hit the redirect
path returns an ENOMEM error. However, before checking for this
condition the redirect scatterlist buffer is setup with a valid
page and length. This is never unwound so when the buffers are
released latter in the error path we do a put_page() and clear
the scatterlist fields. But, because the initial error happens
before completing the scatterlist buffer we end up with both the
original buffer and the redirect buffer pointing to the same page
resulting in duplicate put_page() calls.

To fix this simply move the initial configuration of the redirect
scatterlist buffer below the sock memory check.

Found this while running TCP_STREAM test with netperf using Cilium.

Fixes: fa246693 ("bpf: sockmap, BPF_F_INGRESS flag for BPF_SK_SKB_STREAM_VERDICT")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

parent e20f7334

kernel/bpf/sockmap.c

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -524,8 +524,6 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
	i = md->sg_start;		i = md->sg_start;

	do {		do {
	r->sg_data[i] = md->sg_data[i];

	size = (apply && apply_bytes < md->sg_data[i].length) ?		size = (apply && apply_bytes < md->sg_data[i].length) ?
	apply_bytes : md->sg_data[i].length;		apply_bytes : md->sg_data[i].length;

	@@ -536,6 +534,7 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
	}		}

	sk_mem_charge(sk, size);		sk_mem_charge(sk, size);
			r->sg_data[i] = md->sg_data[i];
	r->sg_data[i].length = size;		r->sg_data[i].length = size;
	md->sg_data[i].length -= size;		md->sg_data[i].length -= size;
	md->sg_data[i].offset += size;		md->sg_data[i].offset += size;