Re: [PATCH net] tun: Remove nested call to bpf_net_ctx_set() in do_xdp_generic()

[Paolo Abeni]

On 7/25/24 04:43, Willem de Bruijn wrote:
> Jeongjun Park wrote:
> > In the previous commit, bpf_net_context handling was added to
> > tun_sendmsg() and do_xdp_generic(), but if you write code like this,
> > bpf_net_context overlaps in the call trace below, causing various
> > memory corruptions.
>
> I'm no expert on this code, but commit 401cb7dae813 that introduced
> bpf_net_ctx_set explicitly states that nested calls are allowed.
>
> And the function does imply that:
>
> static inline struct bpf_net_context *bpf_net_ctx_set(struct bpf_net_context *bpf_net_ctx)
> {
>          struct task_struct *tsk = current;
>
>          if (tsk->bpf_net_context != NULL)
>                  return NULL;
>          bpf_net_ctx->ri.kern_flags = 0;
>
>          tsk->bpf_net_context = bpf_net_ctx;
>          return bpf_net_ctx;
> }

I agree with Willem, the ctx nesting looks legit generally speaking. 
@Jeongjun: you need to track down more accurately the issue root cause 
and include such info into the commit message.

Skimming over the code I *think* do_xdp_generic() is not cleaning the 
nested context in all the paths before return and that could cause the 
reported issue.

Thanks,

Paolo