Commit 703acf62 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'Fix-collisions-in-socket-cookie-generation' 



Daniel Borkmann says:

====================
Fix collisions in socket cookie generation

This change makes the socket cookie generator as a global counter
instead of per netns in order to fix cookie collisions for BPF use
cases we ran into. See main patch #1 for more details.

Given the change is small/trivial and fixes an issue we're seeing
my preference would be net tree (though it cleanly applies to
net-next as well). Went for net tree instead of bpf tree here given
the main change is in net/core/sock_diag.c, but either way would be
fine with me.

v1 -> v2:
  - Fix up commit description in patch #1, thanks Eric!
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 7bac762d 609a2ca5

include/net/net_namespace.h

+0 −1
Original line number Diff line number Diff line
@@ -61,7 +61,6 @@ struct net { 
	spinlock_t		rules_mod_lock;



	u32			hash_mix;

	atomic64_t		cookie_gen;



	struct list_head	list;		/* list of network namespaces */

	struct list_head	exit_list;	/* To linked to call pernet exit

include/uapi/linux/bpf.h

+2 −2
Original line number Diff line number Diff line
@@ -1466,8 +1466,8 @@ union bpf_attr { 
 * 		If no cookie has been set yet, generate a new cookie. Once

 * 		generated, the socket cookie remains stable for the life of the

 * 		socket. This helper can be useful for monitoring per socket

 * 		networking traffic statistics as it provides a unique socket

 * 		identifier per namespace.

 * 		networking traffic statistics as it provides a global socket

 * 		identifier that can be assumed unique.

 * 	Return

 * 		A 8-byte long non-decreasing number on success, or 0 if the

 * 		socket field is missing inside *skb*.

net/core/sock_diag.c

+2 −1
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ static const struct sock_diag_handler *sock_diag_handlers[AF_MAX]; 
static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);

static DEFINE_MUTEX(sock_diag_table_mutex);

static struct workqueue_struct *broadcast_wq;

static atomic64_t cookie_gen;



u64 sock_gen_cookie(struct sock *sk)

{
@@ -27,7 +28,7 @@ u64 sock_gen_cookie(struct sock *sk) 


		if (res)

			return res;

		res = atomic64_inc_return(&sock_net(sk)->cookie_gen);

		res = atomic64_inc_return(&cookie_gen);

		atomic64_cmpxchg(&sk->sk_cookie, 0, res);

	}

}

tools/include/uapi/linux/bpf.h

+7 −4
Original line number Diff line number Diff line
@@ -1466,8 +1466,8 @@ union bpf_attr { 
 * 		If no cookie has been set yet, generate a new cookie. Once

 * 		generated, the socket cookie remains stable for the life of the

 * 		socket. This helper can be useful for monitoring per socket

 * 		networking traffic statistics as it provides a unique socket

 * 		identifier per namespace.

 * 		networking traffic statistics as it provides a global socket

 * 		identifier that can be assumed unique.

 * 	Return

 * 		A 8-byte long non-decreasing number on success, or 0 if the

 * 		socket field is missing inside *skb*.
@@ -1571,8 +1571,11 @@ union bpf_attr { 
 * 		but this is only implemented for native XDP (with driver

 * 		support) as of this writing).

 *

 * 		All values for *flags* are reserved for future usage, and must

 * 		be left at zero.

 * 		The lower two bits of *flags* are used as the return code if

 * 		the map lookup fails. This is so that the return value can be

 * 		one of the XDP program return codes up to XDP_TX, as chosen by

 * 		the caller. Any higher bits in the *flags* argument must be

 * 		unset.

 *

 * 		When used to redirect packets to net devices, this helper

 * 		provides a high performance increase over **bpf_redirect**\ ().

CRA Git | Maintained and supported by SUSTech CRA and CCSE