[v3,1/1] tcp/dcpp: Un-pin tw_timer
Commit Message
The TCP timewait timer is proving to be problematic for setups where scheduler
CPU isolation is achieved at runtime via cpusets (as opposed to statically via
isolcpus=domains).
What happens there is a CPU goes through tcp_time_wait(), arming the time_wait
timer, then gets isolated. TCP_TIMEWAIT_LEN later, the timer fires, causing
interference for the now-isolated CPU. This is conceptually similar to the issue
described in
e02b93124855 ("workqueue: Unbind kworkers before sending them to exit()")
Keep softirqs disabled, but make the timer un-pinned and arm it *after* the
hashdance.
This introduces the following (non-fatal) race:
CPU0 CPU1
allocates a tw
insert it in hash table
finds the TW and removes it
(timer cancel does nothing)
arms a TW timer, lasting
This partially reverts
ed2e92394589 ("tcp/dccp: fix timewait races in timer handling")
and
ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance")
This also reinstores a comment from
ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance")
as inet_twsk_hashdance() had a "Step 1" and "Step 3" comment, but the "Step
2" had gone missing.
Link: https://lore.kernel.org/all/ZPhpfMjSiHVjQkTk@localhost.localdomain/
Signed-off-by: Valentin Schneider <vschneid@redhat.com>
---
net/dccp/minisocks.c | 16 +++++++---------
net/ipv4/inet_timewait_sock.c | 20 +++++++++++++++-----
net/ipv4/tcp_minisocks.c | 16 +++++++---------
3 files changed, 29 insertions(+), 23 deletions(-)
Comments
From: Valentin Schneider <vschneid@redhat.com>
Date: Mon, 19 Feb 2024 10:57:29 +0100
> The TCP timewait timer is proving to be problematic for setups where scheduler
> CPU isolation is achieved at runtime via cpusets (as opposed to statically via
> isolcpus=domains).
>
> What happens there is a CPU goes through tcp_time_wait(), arming the time_wait
> timer, then gets isolated. TCP_TIMEWAIT_LEN later, the timer fires, causing
> interference for the now-isolated CPU. This is conceptually similar to the issue
> described in
> e02b93124855 ("workqueue: Unbind kworkers before sending them to exit()")
>
> Keep softirqs disabled, but make the timer un-pinned and arm it *after* the
> hashdance.
>
> This introduces the following (non-fatal) race:
>
> CPU0 CPU1
> allocates a tw
> insert it in hash table
> finds the TW and removes it
> (timer cancel does nothing)
> arms a TW timer, lasting
>
> This partially reverts
> ed2e92394589 ("tcp/dccp: fix timewait races in timer handling")
> and
> ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance")
>
> This also reinstores a comment from
> ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance")
> as inet_twsk_hashdance() had a "Step 1" and "Step 3" comment, but the "Step
> 2" had gone missing.
>
> Link: https://lore.kernel.org/all/ZPhpfMjSiHVjQkTk@localhost.localdomain/
> Signed-off-by: Valentin Schneider <vschneid@redhat.com>
> ---
> net/dccp/minisocks.c | 16 +++++++---------
> net/ipv4/inet_timewait_sock.c | 20 +++++++++++++++-----
> net/ipv4/tcp_minisocks.c | 16 +++++++---------
> 3 files changed, 29 insertions(+), 23 deletions(-)
>
> diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
> index 64d805b27adde..2f0fad4255e36 100644
> --- a/net/dccp/minisocks.c
> +++ b/net/dccp/minisocks.c
> @@ -53,16 +53,14 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
> if (state == DCCP_TIME_WAIT)
> timeo = DCCP_TIMEWAIT_LEN;
>
> - /* tw_timer is pinned, so we need to make sure BH are disabled
> - * in following section, otherwise timer handler could run before
> - * we complete the initialization.
> - */
> - local_bh_disable();
> - inet_twsk_schedule(tw, timeo);
> - /* Linkage updates.
> - * Note that access to tw after this point is illegal.
> - */
> + local_bh_disable();
This line seems not correctly indented, same for TCP change.
> +
> + // Linkage updates
> inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
> + inet_twsk_schedule(tw, timeo);
> + // Access to tw after this point is illegal.
Also please use /**/ style for these comments, same for TCP too.
> + inet_twsk_put(tw);
> +
> local_bh_enable();
> } else {
> /* Sorry, if we're out of memory, just CLOSE this
On 19/02/24 15:42, Eric Dumazet wrote:
> On Mon, Feb 19, 2024 at 10:57 AM Valentin Schneider <vschneid@redhat.com> wrote:
>>
>> The TCP timewait timer is proving to be problematic for setups where scheduler
>> CPU isolation is achieved at runtime via cpusets (as opposed to statically via
>> isolcpus=domains).
>>
>
> ...
>
>> void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
>> {
>> + /* This can race with tcp_time_wait() and dccp_time_wait(), as the timer
>> + * is armed /after/ adding it to the hashtables.
>> + *
>> + * If this is interleaved between inet_twsk_hashdance() and inet_twsk_put(),
>> + * then this is a no-op: the timer will still end up armed.
>> + *
>> + * Conversely, if this successfully deletes the timer, then we know we
>> + * have already gone through {tcp,dcpp}_time_wait(), and we can safely
>> + * call inet_twsk_kill().
>> + */
>> if (del_timer_sync(&tw->tw_timer))
>> inet_twsk_kill(tw);
>
> I really do not think adding a comment will prevent races at netns dismantle.
>
> We need to make sure the timer is not rearmed, we want to be absolutely
> sure that after inet_twsk_purge() we have no pending timewait sockets,
> otherwise UAF will happen on the netns structures.
>
> I _think_ that you need timer_shutdown_sync() here, instead of del_timer_sync()
Hm so that would indeed prevent a concurrent inet_twsk_schedule() from
re-arming the timer, but in case the calls are interleaved like so:
tcp_time_wait()
inet_twsk_hashdance()
inet_twsk_deschedule_put()
timer_shutdown_sync()
inet_twsk_schedule()
inet_twsk_hashdance() will have left the refcounts including a count for
the timer, and we won't arm the timer to clear it via the timer callback
(via inet_twsk_kill()) - the patch in its current form relies on the timer
being re-armed for that.
I don't know if there's a cleaner way to do this, but we could catch that
in inet_twsk_schedule() and issue the inet_twsk_kill() directly if we can
tell the timer has been shutdown:
---
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 61a053fbd329c..c272da5046bb4 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -227,7 +227,7 @@ void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
* have already gone through {tcp,dcpp}_time_wait(), and we can safely
* call inet_twsk_kill().
*/
- if (del_timer_sync(&tw->tw_timer))
+ if (timer_shutdown_sync(&tw->tw_timer))
inet_twsk_kill(tw);
inet_twsk_put(tw);
}
@@ -267,6 +267,10 @@ void __inet_twsk_schedule(struct inet_timewait_sock *tw, int timeo, bool rearm)
LINUX_MIB_TIMEWAITED);
BUG_ON(mod_timer(&tw->tw_timer, jiffies + timeo));
refcount_inc(&tw->tw_dr->tw_refcount);
+
+ /* XXX timer got shutdown */
+ if (!tw->tw_timer.function)
+ inet_twsk_kill(tw);
} else {
mod_timer_pending(&tw->tw_timer, jiffies + timeo);
}
On 19/02/24 10:55, Kuniyuki Iwashima wrote:
> From: Valentin Schneider <vschneid@redhat.com>
>> @@ -53,16 +53,14 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
>> if (state == DCCP_TIME_WAIT)
>> timeo = DCCP_TIMEWAIT_LEN;
>>
>> - /* tw_timer is pinned, so we need to make sure BH are disabled
>> - * in following section, otherwise timer handler could run before
>> - * we complete the initialization.
>> - */
>> - local_bh_disable();
>> - inet_twsk_schedule(tw, timeo);
>> - /* Linkage updates.
>> - * Note that access to tw after this point is illegal.
>> - */
>> + local_bh_disable();
>
> This line seems not correctly indented, same for TCP change.
>
>
>
>> +
>> + // Linkage updates
>> inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
>> + inet_twsk_schedule(tw, timeo);
>> + // Access to tw after this point is illegal.
>
> Also please use /**/ style for these comments, same for TCP too.
>
Will do, thanks!
@@ -53,16 +53,14 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
if (state == DCCP_TIME_WAIT)
timeo = DCCP_TIMEWAIT_LEN;
- /* tw_timer is pinned, so we need to make sure BH are disabled
- * in following section, otherwise timer handler could run before
- * we complete the initialization.
- */
- local_bh_disable();
- inet_twsk_schedule(tw, timeo);
- /* Linkage updates.
- * Note that access to tw after this point is illegal.
- */
+ local_bh_disable();
+
+ // Linkage updates
inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
+ inet_twsk_schedule(tw, timeo);
+ // Access to tw after this point is illegal.
+ inet_twsk_put(tw);
+
local_bh_enable();
} else {
/* Sorry, if we're out of memory, just CLOSE this
@@ -129,6 +129,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
spin_lock(lock);
+ /* Step 2: Hash TW into tcp ehash chain */
inet_twsk_add_node_rcu(tw, &ehead->chain);
/* Step 3: Remove SK from hash chain */
@@ -137,16 +138,15 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
spin_unlock(lock);
- /* tw_refcnt is set to 3 because we have :
+ /* tw_refcnt is set to 4 because we have :
* - one reference for bhash chain.
* - one reference for ehash chain.
* - one reference for timer.
+ * - one reference for ourself (our caller will release it).
* We can use atomic_set() because prior spin_lock()/spin_unlock()
* committed into memory all tw fields.
- * Also note that after this point, we lost our implicit reference
- * so we are not allowed to use tw anymore.
*/
- refcount_set(&tw->tw_refcnt, 3);
+ refcount_set(&tw->tw_refcnt, 4);
}
EXPORT_SYMBOL_GPL(inet_twsk_hashdance);
@@ -192,7 +192,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
tw->tw_prot = sk->sk_prot_creator;
atomic64_set(&tw->tw_cookie, atomic64_read(&sk->sk_cookie));
twsk_net_set(tw, sock_net(sk));
- timer_setup(&tw->tw_timer, tw_timer_handler, TIMER_PINNED);
+ timer_setup(&tw->tw_timer, tw_timer_handler, 0);
/*
* Because we use RCU lookups, we should not set tw_refcnt
* to a non null value before everything is setup for this
@@ -217,6 +217,16 @@ EXPORT_SYMBOL_GPL(inet_twsk_alloc);
*/
void inet_twsk_deschedule_put(struct inet_timewait_sock *tw)
{
+ /* This can race with tcp_time_wait() and dccp_time_wait(), as the timer
+ * is armed /after/ adding it to the hashtables.
+ *
+ * If this is interleaved between inet_twsk_hashdance() and inet_twsk_put(),
+ * then this is a no-op: the timer will still end up armed.
+ *
+ * Conversely, if this successfully deletes the timer, then we know we
+ * have already gone through {tcp,dcpp}_time_wait(), and we can safely
+ * call inet_twsk_kill().
+ */
if (del_timer_sync(&tw->tw_timer))
inet_twsk_kill(tw);
inet_twsk_put(tw);
@@ -338,16 +338,14 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
if (state == TCP_TIME_WAIT)
timeo = TCP_TIMEWAIT_LEN;
- /* tw_timer is pinned, so we need to make sure BH are disabled
- * in following section, otherwise timer handler could run before
- * we complete the initialization.
- */
- local_bh_disable();
- inet_twsk_schedule(tw, timeo);
- /* Linkage updates.
- * Note that access to tw after this point is illegal.
- */
+ local_bh_disable();
+
+ // Linkage updates.
inet_twsk_hashdance(tw, sk, net->ipv4.tcp_death_row.hashinfo);
+ inet_twsk_schedule(tw, timeo);
+ // Access to tw after this point is illegal.
+ inet_twsk_put(tw);
+
local_bh_enable();
} else {
/* Sorry, if we're out of memory, just CLOSE this