Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0e13a14 authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Daniel Borkmann
Browse files

flow_dissector: lookup netns by skb->sk if skb->dev is NULL 



BPF flow dissectors are configured per network namespace.
__skb_flow_dissect looks up the netns through dev_net(skb->dev).

In some dissector paths skb->dev is NULL, such as for Unix sockets.
In these cases fall back to looking up the netns by socket.

Analyzing the codepaths leading to __skb_flow_dissect I did not find
a case where both skb->dev and skb->sk are NULL. Warn and fall back to
standard flow dissector if one is found.

Fixes: d58e468b ("flow_dissector: implements flow dissector BPF hook")
Reported-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 7ea3c406

net/core/flow_dissector.c

+9 −3
Original line number Diff line number Diff line
@@ -714,7 +714,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb, 
	struct flow_dissector_key_vlan *key_vlan;

	enum flow_dissect_ret fdret;

	enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX;

	struct bpf_prog *attached;

	struct bpf_prog *attached = NULL;

	int num_hdrs = 0;

	u8 ip_proto = 0;

	bool ret;
@@ -755,8 +755,14 @@ bool __skb_flow_dissect(const struct sk_buff *skb, 
					      target_container);



	rcu_read_lock();

	attached = skb ? rcu_dereference(dev_net(skb->dev)->flow_dissector_prog)

		       : NULL;

	if (skb) {

		if (skb->dev)

			attached = rcu_dereference(dev_net(skb->dev)->flow_dissector_prog);

		else if (skb->sk)

			attached = rcu_dereference(sock_net(skb->sk)->flow_dissector_prog);

		else

			WARN_ON_ONCE(1);

	}

	if (attached) {

		/* Note that even though the const qualifier is discarded

		 * throughout the execution of the BPF program, all changes(the