| Message ID | 20220830231946.791504-1-martin.lau@linux.dev (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 84e5a0f208ca341ec1ea88a97c40849a2d541faa |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next,1/2] bpf: net: Avoid loading module when calling bpf_setsockopt(TCP_CONGESTION) | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Tue, 30 Aug 2022 16:19:46 -0700 you wrote: > When bpf prog changes tcp-cc by calling bpf_setsockopt(TCP_CONGESTION), > it should not try to load module which may be a blocking > operation. This details was correct in the v1 [0] but missed by > mistake in the later revision in > commit cb388e7ee3a8 ("bpf: net: Change do_tcp_setsockopt() to use the sockopt's lock_sock() and capable()") > > This patch fixes it by checking the has_current_bpf_ctx(). > > [...] Here is the summary with links: - [bpf-next,1/2] bpf: net: Avoid loading module when calling bpf_setsockopt(TCP_CONGESTION) https://git.kernel.org/bpf/bpf-next/c/84e5a0f208ca - [bpf-next,2/2] selftest/bpf: Ensure no module loading in bpf_setsockopt(TCP_CONGESTION) https://git.kernel.org/bpf/bpf-next/c/197072945a70 You are awesome, thank you!
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index a6986f201f92..f0d79ea45ac8 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3503,7 +3503,7 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname, name[val] = 0; sockopt_lock_sock(sk); - err = tcp_set_congestion_control(sk, name, true, + err = tcp_set_congestion_control(sk, name, !has_current_bpf_ctx(), sockopt_ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)); sockopt_release_sock(sk);
When bpf prog changes tcp-cc by calling bpf_setsockopt(TCP_CONGESTION), it should not try to load module which may be a blocking operation. This details was correct in the v1 [0] but missed by mistake in the later revision in commit cb388e7ee3a8 ("bpf: net: Change do_tcp_setsockopt() to use the sockopt's lock_sock() and capable()") This patch fixes it by checking the has_current_bpf_ctx(). [0]: https://lore.kernel.org/bpf/20220727060921.2373314-1-kafai@fb.com/ Fixes: cb388e7ee3a8 ("bpf: net: Change do_tcp_setsockopt() to use the sockopt's lock_sock() and capable()") Signed-off-by: Martin KaFai Lau <martin.lau@linux.dev> --- net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)