Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d650cde authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: fix tcp_set_congestion_control() use from bpf hook 



Neal reported incorrect use of ns_capable() from bpf hook.

bpf_setsockopt(...TCP_CONGESTION...)
  -> tcp_set_congestion_control()
   -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)
    -> ns_capable_common()
     -> current_cred()
      -> rcu_dereference_protected(current->cred, 1)

Accessing 'current' in bpf context makes no sense, since packets
are processed from softirq context.

As Neal stated : The capability check in tcp_set_congestion_control()
was written assuming a system call context, and then was reused from
a BPF call site.

The fix is to add a new parameter to tcp_set_congestion_control(),
so that the ns_capable() call is only performed under the right
context.

Fixes: 91b5b21c ("bpf: Add support for changing congestion control")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Lawrence Brakmo <brakmo@fb.com>
Reported-by: default avatarNeal Cardwell <ncardwell@google.com>
Acked-by: default avatarNeal Cardwell <ncardwell@google.com>
Acked-by: default avatarLawrence Brakmo <brakmo@fb.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 269b7c5f

include/net/tcp.h

+2 −1
Original line number Diff line number Diff line
@@ -1064,7 +1064,8 @@ void tcp_get_default_congestion_control(struct net *net, char *name); 
void tcp_get_available_congestion_control(char *buf, size_t len);

void tcp_get_allowed_congestion_control(char *buf, size_t len);

int tcp_set_allowed_congestion_control(char *allowed);

int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit);

int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,

			       bool reinit, bool cap_net_admin);

u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);

void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);

net/core/filter.c

+1 −1
Original line number Diff line number Diff line
@@ -4335,7 +4335,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, 
						    TCP_CA_NAME_MAX-1));

			name[TCP_CA_NAME_MAX-1] = 0;

			ret = tcp_set_congestion_control(sk, name, false,

							 reinit);

							 reinit, true);

		} else {

			struct tcp_sock *tp = tcp_sk(sk);

net/ipv4/tcp.c

+3 −1
Original line number Diff line number Diff line
@@ -2785,7 +2785,9 @@ static int do_tcp_setsockopt(struct sock *sk, int level, 
		name[val] = 0;



		lock_sock(sk);

		err = tcp_set_congestion_control(sk, name, true, true);

		err = tcp_set_congestion_control(sk, name, true, true,

						 ns_capable(sock_net(sk)->user_ns,

							    CAP_NET_ADMIN));

		release_sock(sk);

		return err;

	}

net/ipv4/tcp_cong.c

+3 −3
Original line number Diff line number Diff line
@@ -333,7 +333,8 @@ int tcp_set_allowed_congestion_control(char *val) 
 * tcp_reinit_congestion_control (if the current congestion control was

 * already initialized.

 */

int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit)

int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,

			       bool reinit, bool cap_net_admin)

{

	struct inet_connection_sock *icsk = inet_csk(sk);

	const struct tcp_congestion_ops *ca;
@@ -369,8 +370,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, boo 
		} else {

			err = -EBUSY;

		}

	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||

		     ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) {

	} else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) {

		err = -EPERM;

	} else if (!try_module_get(ca->owner)) {

		err = -EBUSY;