3ebc46ca86
In dctcp_update_alpha(), we use a module parameter dctcp_shift_g
as follows:
alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
...
delivered_ce <<= (10 - dctcp_shift_g);
It seems syzkaller started fuzzing module parameters and triggered
shift-out-of-bounds [0] by setting 100 to dctcp_shift_g:
memcpy((void*)0x20000080,
"/sys/module/tcp_dctcp/parameters/dctcp_shift_g\000", 47);
res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul,
/*flags=*/2ul, /*mode=*/0ul);
memcpy((void*)0x20000000, "100\000", 4);
syscall(__NR_write, /*fd=*/r[0], /*val=*/0x20000000ul, /*len=*/4ul);
Let's limit the max value of dctcp_shift_g by param_set_uint_minmax().
With this patch:
# echo 10 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
# cat /sys/module/tcp_dctcp/parameters/dctcp_shift_g
10
# echo 11 > /sys/module/tcp_dctcp/parameters/dctcp_shift_g
-bash: echo: write error: Invalid argument
[0]:
UBSAN: shift-out-of-bounds in net/ipv4/tcp_dctcp.c:143:12
shift exponent 100 is too large for 32-bit type 'u32' (aka 'unsigned int')
CPU: 0 PID: 8083 Comm: syz-executor345 Not tainted 6.9.0-05151-g1b294a1f3561 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x201/0x300 lib/dump_stack.c:114
ubsan_epilogue lib/ubsan.c:231 [inline]
__ubsan_handle_shift_out_of_bounds+0x346/0x3a0 lib/ubsan.c:468
dctcp_update_alpha+0x540/0x570 net/ipv4/tcp_dctcp.c:143
tcp_in_ack_event net/ipv4/tcp_input.c:3802 [inline]
tcp_ack+0x17b1/0x3bc0 net/ipv4/tcp_input.c:3948
tcp_rcv_state_process+0x57a/0x2290 net/ipv4/tcp_input.c:6711
tcp_v4_do_rcv+0x764/0xc40 net/ipv4/tcp_ipv4.c:1937
sk_backlog_rcv include/net/sock.h:1106 [inline]
__release_sock+0x20f/0x350 net/core/sock.c:2983
release_sock+0x61/0x1f0 net/core/sock.c:3549
mptcp_subflow_shutdown+0x3d0/0x620 net/mptcp/protocol.c:2907
mptcp_check_send_data_fin+0x225/0x410 net/mptcp/protocol.c:2976
__mptcp_close+0x238/0xad0 net/mptcp/protocol.c:3072
mptcp_close+0x2a/0x1a0 net/mptcp/protocol.c:3127
inet_release+0x190/0x1f0 net/ipv4/af_inet.c:437
__sock_release net/socket.c:659 [inline]
sock_close+0xc0/0x240 net/socket.c:1421
__fput+0x41b/0x890 fs/file_table.c:422
task_work_run+0x23b/0x300 kernel/task_work.c:180
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x9c8/0x2540 kernel/exit.c:878
do_group_exit+0x201/0x2b0 kernel/exit.c:1027
__do_sys_exit_group kernel/exit.c:1038 [inline]
__se_sys_exit_group kernel/exit.c:1036 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xe4/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x7f6c2b5005b6
Code: Unable to access opcode bytes at 0x7f6c2b50058c.
RSP: 002b:00007ffe883eb948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f6c2b5862f0 RCX: 00007f6c2b5005b6
RDX: 0000000000000001 RSI: 000000000000003c RDI: 0000000000000001
RBP: 0000000000000001 R08: 00000000000000e7 R09: ffffffffffffffc0
R10: 0000000000000006 R11: 0000000000000246 R12: 00007f6c2b5862f0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001
</TASK>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Reported-by: Yue Sun <samsun1006219@gmail.com>
Reported-by: xingwei lee <xrivendell7@gmail.com>
Closes: https://lore.kernel.org/netdev/CAEkJfYNJM=cw-8x7_Vmj1J6uYVCWMbbvD=EFmDPVBGpTsqOxEA@mail.gmail.com/
Fixes: e3118e8359
("net: tcp: add DCTCP congestion control algorithm")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240517091626.32772-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
314 lines
8.9 KiB
C
314 lines
8.9 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/* DataCenter TCP (DCTCP) congestion control.
|
|
*
|
|
* http://simula.stanford.edu/~alizade/Site/DCTCP.html
|
|
*
|
|
* This is an implementation of DCTCP over Reno, an enhancement to the
|
|
* TCP congestion control algorithm designed for data centers. DCTCP
|
|
* leverages Explicit Congestion Notification (ECN) in the network to
|
|
* provide multi-bit feedback to the end hosts. DCTCP's goal is to meet
|
|
* the following three data center transport requirements:
|
|
*
|
|
* - High burst tolerance (incast due to partition/aggregate)
|
|
* - Low latency (short flows, queries)
|
|
* - High throughput (continuous data updates, large file transfers)
|
|
* with commodity shallow buffered switches
|
|
*
|
|
* The algorithm is described in detail in the following two papers:
|
|
*
|
|
* 1) Mohammad Alizadeh, Albert Greenberg, David A. Maltz, Jitendra Padhye,
|
|
* Parveen Patel, Balaji Prabhakar, Sudipta Sengupta, and Murari Sridharan:
|
|
* "Data Center TCP (DCTCP)", Data Center Networks session
|
|
* Proc. ACM SIGCOMM, New Delhi, 2010.
|
|
* http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp-final.pdf
|
|
*
|
|
* 2) Mohammad Alizadeh, Adel Javanmard, and Balaji Prabhakar:
|
|
* "Analysis of DCTCP: Stability, Convergence, and Fairness"
|
|
* Proc. ACM SIGMETRICS, San Jose, 2011.
|
|
* http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp_analysis-full.pdf
|
|
*
|
|
* Initial prototype from Abdul Kabbani, Masato Yasuda and Mohammad Alizadeh.
|
|
*
|
|
* Authors:
|
|
*
|
|
* Daniel Borkmann <dborkman@redhat.com>
|
|
* Florian Westphal <fw@strlen.de>
|
|
* Glenn Judd <glenn.judd@morganstanley.com>
|
|
*/
|
|
|
|
#include <linux/btf.h>
|
|
#include <linux/btf_ids.h>
|
|
#include <linux/module.h>
|
|
#include <linux/mm.h>
|
|
#include <net/tcp.h>
|
|
#include <linux/inet_diag.h>
|
|
#include "tcp_dctcp.h"
|
|
|
|
#define DCTCP_MAX_ALPHA 1024U
|
|
|
|
struct dctcp {
|
|
u32 old_delivered;
|
|
u32 old_delivered_ce;
|
|
u32 prior_rcv_nxt;
|
|
u32 dctcp_alpha;
|
|
u32 next_seq;
|
|
u32 ce_state;
|
|
u32 loss_cwnd;
|
|
struct tcp_plb_state plb;
|
|
};
|
|
|
|
static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
|
|
|
|
static int dctcp_shift_g_set(const char *val, const struct kernel_param *kp)
|
|
{
|
|
return param_set_uint_minmax(val, kp, 0, 10);
|
|
}
|
|
|
|
static const struct kernel_param_ops dctcp_shift_g_ops = {
|
|
.set = dctcp_shift_g_set,
|
|
.get = param_get_uint,
|
|
};
|
|
|
|
module_param_cb(dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g, 0644);
|
|
MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha");
|
|
|
|
static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
|
|
module_param(dctcp_alpha_on_init, uint, 0644);
|
|
MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
|
|
|
|
static struct tcp_congestion_ops dctcp_reno;
|
|
|
|
static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
|
|
{
|
|
ca->next_seq = tp->snd_nxt;
|
|
|
|
ca->old_delivered = tp->delivered;
|
|
ca->old_delivered_ce = tp->delivered_ce;
|
|
}
|
|
|
|
__bpf_kfunc static void dctcp_init(struct sock *sk)
|
|
{
|
|
const struct tcp_sock *tp = tcp_sk(sk);
|
|
|
|
if ((tp->ecn_flags & TCP_ECN_OK) ||
|
|
(sk->sk_state == TCP_LISTEN ||
|
|
sk->sk_state == TCP_CLOSE)) {
|
|
struct dctcp *ca = inet_csk_ca(sk);
|
|
|
|
ca->prior_rcv_nxt = tp->rcv_nxt;
|
|
|
|
ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
|
|
|
|
ca->loss_cwnd = 0;
|
|
ca->ce_state = 0;
|
|
|
|
dctcp_reset(tp, ca);
|
|
tcp_plb_init(sk, &ca->plb);
|
|
|
|
return;
|
|
}
|
|
|
|
/* No ECN support? Fall back to Reno. Also need to clear
|
|
* ECT from sk since it is set during 3WHS for DCTCP.
|
|
*/
|
|
inet_csk(sk)->icsk_ca_ops = &dctcp_reno;
|
|
INET_ECN_dontxmit(sk);
|
|
}
|
|
|
|
__bpf_kfunc static u32 dctcp_ssthresh(struct sock *sk)
|
|
{
|
|
struct dctcp *ca = inet_csk_ca(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
|
|
ca->loss_cwnd = tcp_snd_cwnd(tp);
|
|
return max(tcp_snd_cwnd(tp) - ((tcp_snd_cwnd(tp) * ca->dctcp_alpha) >> 11U), 2U);
|
|
}
|
|
|
|
__bpf_kfunc static void dctcp_update_alpha(struct sock *sk, u32 flags)
|
|
{
|
|
const struct tcp_sock *tp = tcp_sk(sk);
|
|
struct dctcp *ca = inet_csk_ca(sk);
|
|
|
|
/* Expired RTT */
|
|
if (!before(tp->snd_una, ca->next_seq)) {
|
|
u32 delivered = tp->delivered - ca->old_delivered;
|
|
u32 delivered_ce = tp->delivered_ce - ca->old_delivered_ce;
|
|
u32 alpha = ca->dctcp_alpha;
|
|
u32 ce_ratio = 0;
|
|
|
|
if (delivered > 0) {
|
|
/* dctcp_alpha keeps EWMA of fraction of ECN marked
|
|
* packets. Because of EWMA smoothing, PLB reaction can
|
|
* be slow so we use ce_ratio which is an instantaneous
|
|
* measure of congestion. ce_ratio is the fraction of
|
|
* ECN marked packets in the previous RTT.
|
|
*/
|
|
if (delivered_ce > 0)
|
|
ce_ratio = (delivered_ce << TCP_PLB_SCALE) / delivered;
|
|
tcp_plb_update_state(sk, &ca->plb, (int)ce_ratio);
|
|
tcp_plb_check_rehash(sk, &ca->plb);
|
|
}
|
|
|
|
/* alpha = (1 - g) * alpha + g * F */
|
|
|
|
alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
|
|
if (delivered_ce) {
|
|
|
|
/* If dctcp_shift_g == 1, a 32bit value would overflow
|
|
* after 8 M packets.
|
|
*/
|
|
delivered_ce <<= (10 - dctcp_shift_g);
|
|
delivered_ce /= max(1U, delivered);
|
|
|
|
alpha = min(alpha + delivered_ce, DCTCP_MAX_ALPHA);
|
|
}
|
|
/* dctcp_alpha can be read from dctcp_get_info() without
|
|
* synchro, so we ask compiler to not use dctcp_alpha
|
|
* as a temporary variable in prior operations.
|
|
*/
|
|
WRITE_ONCE(ca->dctcp_alpha, alpha);
|
|
dctcp_reset(tp, ca);
|
|
}
|
|
}
|
|
|
|
static void dctcp_react_to_loss(struct sock *sk)
|
|
{
|
|
struct dctcp *ca = inet_csk_ca(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
|
|
ca->loss_cwnd = tcp_snd_cwnd(tp);
|
|
tp->snd_ssthresh = max(tcp_snd_cwnd(tp) >> 1U, 2U);
|
|
}
|
|
|
|
__bpf_kfunc static void dctcp_state(struct sock *sk, u8 new_state)
|
|
{
|
|
if (new_state == TCP_CA_Recovery &&
|
|
new_state != inet_csk(sk)->icsk_ca_state)
|
|
dctcp_react_to_loss(sk);
|
|
/* We handle RTO in dctcp_cwnd_event to ensure that we perform only
|
|
* one loss-adjustment per RTT.
|
|
*/
|
|
}
|
|
|
|
__bpf_kfunc static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
|
|
{
|
|
struct dctcp *ca = inet_csk_ca(sk);
|
|
|
|
switch (ev) {
|
|
case CA_EVENT_ECN_IS_CE:
|
|
case CA_EVENT_ECN_NO_CE:
|
|
dctcp_ece_ack_update(sk, ev, &ca->prior_rcv_nxt, &ca->ce_state);
|
|
break;
|
|
case CA_EVENT_LOSS:
|
|
tcp_plb_update_state_upon_rto(sk, &ca->plb);
|
|
dctcp_react_to_loss(sk);
|
|
break;
|
|
case CA_EVENT_TX_START:
|
|
tcp_plb_check_rehash(sk, &ca->plb); /* Maybe rehash when inflight is 0 */
|
|
break;
|
|
default:
|
|
/* Don't care for the rest. */
|
|
break;
|
|
}
|
|
}
|
|
|
|
static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
|
|
union tcp_cc_info *info)
|
|
{
|
|
const struct dctcp *ca = inet_csk_ca(sk);
|
|
const struct tcp_sock *tp = tcp_sk(sk);
|
|
|
|
/* Fill it also in case of VEGASINFO due to req struct limits.
|
|
* We can still correctly retrieve it later.
|
|
*/
|
|
if (ext & (1 << (INET_DIAG_DCTCPINFO - 1)) ||
|
|
ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
|
|
memset(&info->dctcp, 0, sizeof(info->dctcp));
|
|
if (inet_csk(sk)->icsk_ca_ops != &dctcp_reno) {
|
|
info->dctcp.dctcp_enabled = 1;
|
|
info->dctcp.dctcp_ce_state = (u16) ca->ce_state;
|
|
info->dctcp.dctcp_alpha = ca->dctcp_alpha;
|
|
info->dctcp.dctcp_ab_ecn = tp->mss_cache *
|
|
(tp->delivered_ce - ca->old_delivered_ce);
|
|
info->dctcp.dctcp_ab_tot = tp->mss_cache *
|
|
(tp->delivered - ca->old_delivered);
|
|
}
|
|
|
|
*attr = INET_DIAG_DCTCPINFO;
|
|
return sizeof(info->dctcp);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
__bpf_kfunc static u32 dctcp_cwnd_undo(struct sock *sk)
|
|
{
|
|
const struct dctcp *ca = inet_csk_ca(sk);
|
|
struct tcp_sock *tp = tcp_sk(sk);
|
|
|
|
return max(tcp_snd_cwnd(tp), ca->loss_cwnd);
|
|
}
|
|
|
|
static struct tcp_congestion_ops dctcp __read_mostly = {
|
|
.init = dctcp_init,
|
|
.in_ack_event = dctcp_update_alpha,
|
|
.cwnd_event = dctcp_cwnd_event,
|
|
.ssthresh = dctcp_ssthresh,
|
|
.cong_avoid = tcp_reno_cong_avoid,
|
|
.undo_cwnd = dctcp_cwnd_undo,
|
|
.set_state = dctcp_state,
|
|
.get_info = dctcp_get_info,
|
|
.flags = TCP_CONG_NEEDS_ECN,
|
|
.owner = THIS_MODULE,
|
|
.name = "dctcp",
|
|
};
|
|
|
|
static struct tcp_congestion_ops dctcp_reno __read_mostly = {
|
|
.ssthresh = tcp_reno_ssthresh,
|
|
.cong_avoid = tcp_reno_cong_avoid,
|
|
.undo_cwnd = tcp_reno_undo_cwnd,
|
|
.get_info = dctcp_get_info,
|
|
.owner = THIS_MODULE,
|
|
.name = "dctcp-reno",
|
|
};
|
|
|
|
BTF_KFUNCS_START(tcp_dctcp_check_kfunc_ids)
|
|
BTF_ID_FLAGS(func, dctcp_init)
|
|
BTF_ID_FLAGS(func, dctcp_update_alpha)
|
|
BTF_ID_FLAGS(func, dctcp_cwnd_event)
|
|
BTF_ID_FLAGS(func, dctcp_ssthresh)
|
|
BTF_ID_FLAGS(func, dctcp_cwnd_undo)
|
|
BTF_ID_FLAGS(func, dctcp_state)
|
|
BTF_KFUNCS_END(tcp_dctcp_check_kfunc_ids)
|
|
|
|
static const struct btf_kfunc_id_set tcp_dctcp_kfunc_set = {
|
|
.owner = THIS_MODULE,
|
|
.set = &tcp_dctcp_check_kfunc_ids,
|
|
};
|
|
|
|
static int __init dctcp_register(void)
|
|
{
|
|
int ret;
|
|
|
|
BUILD_BUG_ON(sizeof(struct dctcp) > ICSK_CA_PRIV_SIZE);
|
|
|
|
ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &tcp_dctcp_kfunc_set);
|
|
if (ret < 0)
|
|
return ret;
|
|
return tcp_register_congestion_control(&dctcp);
|
|
}
|
|
|
|
static void __exit dctcp_unregister(void)
|
|
{
|
|
tcp_unregister_congestion_control(&dctcp);
|
|
}
|
|
|
|
module_init(dctcp_register);
|
|
module_exit(dctcp_unregister);
|
|
|
|
MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
|
|
MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
|
|
MODULE_AUTHOR("Glenn Judd <glenn.judd@morganstanley.com>");
|
|
|
|
MODULE_LICENSE("GPL v2");
|
|
MODULE_DESCRIPTION("DataCenter TCP (DCTCP)");
|