Commit 67f8f2ba authored Aug 17, 2023 by Yan Zhai Committed by Greg Kroah-Hartman Sep 23, 2023

lwt: Fix return values of BPF xmit ops



[ Upstream commit 29b22badb7a84b783e3a4fffca16f7768fb31205 ]

BPF encap ops can return different types of positive values, such like
NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function
skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return
values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in
ip(6)_finish_output2. When this happens, skbs that have been freed would
continue to the neighbor subsystem, causing use-after-free bug and
kernel crashes.

To fix the incorrect behavior, skb_do_redirect return values can be
simply discarded, the same as tc-egress behavior. On the other hand,
bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU
information. Thus convert its return values to avoid the conflict with
LWTUNNEL_XMIT_CONTINUE.

Fixes: 3a0af8fd ("bpf: BPF for lightweight tunnel infrastructure")
Reported-by: Jordan Griege <jgriege@cloudflare.com>
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Suggested-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/0d2b878186cfe215fec6b45769c1cd0591d3628d.1692326837.git.yan@cloudflare.com


Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 12bf7d9c

net/core/lwt_bpf.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -59,8 +59,7 @@ static int run_lwt_bpf(struct sk_buff skb, struct bpf_lwt_prog lwt,
		ret = BPF_OK;
		} else {
		skb_reset_mac_header(skb);
		ret = skb_do_redirect(skb);
		if (ret == 0)
		skb_do_redirect(skb);
		ret = BPF_REDIRECT;
		}
		break;
		@@ -254,7 +253,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)

		err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
		if (unlikely(err))
		return err;
		return net_xmit_errno(err);

		/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
		return LWTUNNEL_XMIT_DONE;