Skip to content

Commit d888b7a

Browse files
Zijian Zhangborkmann
authored andcommitted
tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection
When we do sk_psock_verdict_apply->sk_psock_skb_ingress, an sk_msg will be created out of the skb, and the rmem accounting of the sk_msg will be handled by the skb. For skmsgs in __SK_REDIRECT case of tcp_bpf_send_verdict, when redirecting to the ingress of a socket, although we sk_rmem_schedule and add sk_msg to the ingress_msg of sk_redir, we do not update sk_rmem_alloc. As a result, except for the global memory limit, the rmem of sk_redir is nearly unlimited. Thus, add sk_rmem_alloc related logic to limit the recv buffer. Since the function sk_msg_recvmsg and __sk_psock_purge_ingress_msg are used in these two paths. We use "msg->skb" to test whether the sk_msg is skb backed up. If it's not, we shall do the memory accounting explicitly. Fixes: 604326b ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Zijian Zhang <zijianzhang@bytedance.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/bpf/20241210012039.1669389-3-zijianzhang@bytedance.com
1 parent 54f89b3 commit d888b7a

File tree

3 files changed

+16
-5
lines changed

3 files changed

+16
-5
lines changed

include/linux/skmsg.h

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -317,17 +317,22 @@ static inline void sock_drop(struct sock *sk, struct sk_buff *skb)
317317
kfree_skb(skb);
318318
}
319319

320-
static inline void sk_psock_queue_msg(struct sk_psock *psock,
320+
static inline bool sk_psock_queue_msg(struct sk_psock *psock,
321321
struct sk_msg *msg)
322322
{
323+
bool ret;
324+
323325
spin_lock_bh(&psock->ingress_lock);
324-
if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
326+
if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
325327
list_add_tail(&msg->list, &psock->ingress_msg);
326-
else {
328+
ret = true;
329+
} else {
327330
sk_msg_free(psock->sk, msg);
328331
kfree(msg);
332+
ret = false;
329333
}
330334
spin_unlock_bh(&psock->ingress_lock);
335+
return ret;
331336
}
332337

333338
static inline struct sk_msg *sk_psock_dequeue_msg(struct sk_psock *psock)

net/core/skmsg.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -445,8 +445,10 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
445445
if (likely(!peek)) {
446446
sge->offset += copy;
447447
sge->length -= copy;
448-
if (!msg_rx->skb)
448+
if (!msg_rx->skb) {
449449
sk_mem_uncharge(sk, copy);
450+
atomic_sub(copy, &sk->sk_rmem_alloc);
451+
}
450452
msg_rx->sg.size -= copy;
451453

452454
if (!sge->length) {
@@ -772,6 +774,8 @@ static void __sk_psock_purge_ingress_msg(struct sk_psock *psock)
772774

773775
list_for_each_entry_safe(msg, tmp, &psock->ingress_msg, list) {
774776
list_del(&msg->list);
777+
if (!msg->skb)
778+
atomic_sub(msg->sg.size, &psock->sk->sk_rmem_alloc);
775779
sk_msg_free(psock->sk, msg);
776780
kfree(msg);
777781
}

net/ipv4/tcp_bpf.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
5656
}
5757

5858
sk_mem_charge(sk, size);
59+
atomic_add(size, &sk->sk_rmem_alloc);
5960
sk_msg_xfer(tmp, msg, i, size);
6061
copied += size;
6162
if (sge->length)
@@ -74,7 +75,8 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock,
7475

7576
if (!ret) {
7677
msg->sg.start = i;
77-
sk_psock_queue_msg(psock, tmp);
78+
if (!sk_psock_queue_msg(psock, tmp))
79+
atomic_sub(copied, &sk->sk_rmem_alloc);
7880
sk_psock_data_ready(sk, psock);
7981
} else {
8082
sk_msg_free(sk, tmp);

0 commit comments

Comments
 (0)