Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 16 Aug 2022 17:43:19 -0700
From:   Martin KaFai Lau <kafai@fb.com>
To:     Jakub Kicinski <kuba@kernel.org>
Cc:     David Howells <dhowells@redhat.com>,
        Hawkins Jiawei <yin31149@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        bpf@vger.kernel.org, Jakub Sitnicki <jakub@cloudflare.com>
Subject: Re: [PATCH] net: Fix suspicious RCU usage in
 bpf_sk_reuseport_detach()
Message-ID: <20220817004319.fd7dekpqeumbvmsh@kafai-mbp>
References: <20220816103452.479281-1-yin31149@gmail.com>
 <166064248071.3502205.10036394558814861778.stgit@warthog.procyon.org.uk>
 <804153.1660684606@warthog.procyon.org.uk>
 <20220816164435.0558ef94@kernel.org>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220816164435.0558ef94@kernel.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?zTgPRFla0xL3Ow6uCADnAlBNTbBo3QmAuji+C0qwaF6aFVjqmSKkB9IVaHaf?=
 =?us-ascii?Q?6gjFpIlUqSw50J6oEySAM0PRaHz2N31gSFqC2d9bC9bA0QW36k4J6J7FdHXy?=
 =?us-ascii?Q?47HerSJzxbbMMOP2Y+u89tWTe7P0DiEbjooKCuUGjxsxME+CbkL7k7+CdNSn?=
 =?us-ascii?Q?X2veQcoTBeFCe8juCsIAQGN6cCWzfnfec0Ky1ZDk7OkbG77seukPE2ZkQiny?=
 =?us-ascii?Q?j6PGX1TTdK0HHytLm2qWHd60wqwrRaY8gmT7gwm/x7Swq/+z+74gLOx8dKwU?=
 =?us-ascii?Q?kp5+K+j3JduGQi3M2yy3OCM9apMpw40HWVZA864N58SkxYCuep/AR5z29BK6?=
 =?us-ascii?Q?KSI3BMrAyL5MqCbF4B7EtVo7Y9v7UoqzOgeORxQhthbiKIK86dNRhn1zcPqk?=
 =?us-ascii?Q?/JkijTLGyr1o+8DFTgAsKRyZ+Mvh25dVbFDsRK+y9ovFLgj6Q/uNHE0x2lr4?=
 =?us-ascii?Q?l0KWWiFrETI4InS/bkYdiBYM/CZmPNhGT3jf3LKfrtFDN/vAj3JsNpCuNptv?=
 =?us-ascii?Q?6bI+cgDm3ea/juAO1anOP1EEk0CjaMpSEeyMPCJ+74BO0Bw32wAjWZP5s0It?=
 =?us-ascii?Q?8NfzVuaX7Jom+8qopS7iTrJ3j0NQV8EdVbcpsodVZx2rqZ2GL/97yU1dUBSf?=
 =?us-ascii?Q?Yo12xCyxtJ3apj3enD0AUv00xIHR2YUCa5IqgojVOu6AB4yT9pcc0QqmlNF3?=
 =?us-ascii?Q?MJ1Xp82izPOe9SYCtC5M8wHsNiclvefvpPX3eV8YDBLbjGUIVGHhiUWalrxt?=
 =?us-ascii?Q?WAw7/Hc4zbefhIjIP5eEzCLIND2x1y8U5WNlfhpEMSJbcoJqIBDY3jdH/63l?=
 =?us-ascii?Q?OW5q6GrhGbn41yMDsIHdvrqgv2mB8pfG8T3vi3j2ELOy0CW/obrVZnXCB8QR?=
 =?us-ascii?Q?o2YZ8jiCMokcemlabjcvi0jDTkAtzSWQWrQPQ+O2KKU5CDqoKjaVjztPcxPH?=
 =?us-ascii?Q?WelmvLTC1lfkVV3hWUdJcIBbwQuQL0rvmlg0WNrJAK8IKf9OJlBgLTQrxA5/?=
 =?us-ascii?Q?N/f3ODDsLmoi2H/2LeT5wIskUo6z2V5lk/jW6WK1RoEZ1cF3JnVC2IgOQqeA?=
 =?us-ascii?Q?fF01H4WqY0Vi1HfhfBm9J1kGf504nUxnOWUppxhXOjn2m0hYsZ9teN5nO3zK?=
 =?us-ascii?Q?VwfLwcKFS7hkfo5/xezB1Cqw5+jUVDL1dXeAhbkro6ZcYfNDWu5e3sHkykik?=
 =?us-ascii?Q?L4w6R8UtJnlFt6k/K9uX9yrCFveGb/blGUaeMYeD72+1C6pYlrNJB1cmNzFk?=
 =?us-ascii?Q?fIvP/zYsTL5SnIq7Pb2okJr3t298VTGFPN2QLO9IvHtLj8dkoSUNZT/7QdM6?=
 =?us-ascii?Q?azoFoscnVJhiYaN1E0C2Ojkr0q53Zvk20GRazRSeDKBntraBOanP6/t8IXdd?=
 =?us-ascii?Q?4YS8JwIgQ/MFgWx0Nu3Qbr/3UZRX7IQjPxbJ7AGiDmBzvM+3CCaGpiQVtfkc?=
 =?us-ascii?Q?CWJKVfJjHUeJOpTuiqzPd5pbF1ISjP46NWNp6UUeKoPy/2CcLMtXI541Yd9d?=
 =?us-ascii?Q?t16fC7qaHAhpqLwyIgXcGgspgcGlU0bYTpS4ispjhfsVggSfyjY+Zz7MsBdj?=
 =?us-ascii?Q?XJhct7o/KYwKTGEEyYPW9dt2ifAU0+PBg6ZyYref?=
X-OriginatorOrg: fb.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5f2d51a2-aec4-4f00-1dc1-08da7fe97c56
X-MS-Exchange-CrossTenant-AuthSource: MW4PR15MB4475.namprd15.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Aug 2022 00:43:21.8347
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5rQnRaKBp4ZsvATWbA5QrNiUGtLp7jHVEw9SlBJ8awLtOdZ1bsHwaH8/G9x37yTJ
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR15MB4520
X-Proofpoint-GUID: WHJOkSY9WWWm6BJ2kXO2JpPO-MAcCl1c
X-Proofpoint-ORIG-GUID: WHJOkSY9WWWm6BJ2kXO2JpPO-MAcCl1c
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-16_08,2022-08-16_02,2022-06-22_01
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Aug 16, 2022 at 04:44:35PM -0700, Jakub Kicinski wrote:
> On Tue, 16 Aug 2022 22:16:46 +0100 David Howells wrote:
> > So either __rcu_dereference_sk_user_data_with_flags_check() has to be a macro,
> > or we need to go with something like the first version of my patch where I
> > don't pass the condition through.  Do you have a preference?
> 
> I like your version because it documents what the lock protecting this
> field is.
> 
> In fact should we also add && sock_owned_by_user(). Martin, WDYT? Would
> that work for reuseport? Jakub S is fixing l2tp to hold the socket lock
> while setting this field, yet most places take the callback lock...
It needs to take a closer look at where the lock_sock() has already
been acquired and also need to consider the lock ordering with reuseport_lock.
It probably should work but may need a separate patch to discuss those
considerations ?

> 
> One the naming - maybe just drop the _with_flags() ? There's no version
> of locked helper which does not take the flags. And not underscores?
I am also good with a shorter name.

Could a comment be added to bpf_sk_reuseport_detach() mentioning
sk_user_data access is protected by the sk_callback_lock alone (or the lock
sock in the future) while reusing __locked_read_sk_user_data() with
a rcu_dereference().  It will be easier to understand if there is
actually any rcu reader in the future code reading.