Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-25 Thread William Tu
Hi, I've tested on kvm and encountered similar issue. If I boot up VM with CPU hotplug enabled like below: ./qemu-system-x86_64 -smp 2, maxcpus=4 then the ' /sys/devices/system/cpu/possible' does not equal to the number of cpu* dirs in ' /sys/devices/system/cpu/', which will crash the percpu map

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-18 Thread William Tu
Hi Alexei and Daniel, I got feedback from Fusion bios/chipset team. In short, the value 'possible' includes empty CPU socket. To verify, I tested on a physical Xeon machine with 2 CPU sockets, one of them is empty. I got 'possible' = 0-239, the number of 'cpu*' =12. As a result, extra bytes are co

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-12 Thread Alexei Starovoitov
On Fri, Aug 12, 2016 at 09:58:51AM -0700, William Tu wrote: > Hi, > > I've tested on ESXi version 5.5 and it seems OK. > - VM1: Ubuntu 14.04, kernel 3.19 ---> OK 3 cpu dirs, possible = 0-2 > - VM2: Centos7, kernel 3.10 ---> OK 8 cpu dirs, possible = 0-7 > > I tried another MacBook with Fusion, sa

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-12 Thread William Tu
Hi, I've tested on ESXi version 5.5 and it seems OK. - VM1: Ubuntu 14.04, kernel 3.19 ---> OK 3 cpu dirs, possible = 0-2 - VM2: Centos7, kernel 3.10 ---> OK 8 cpu dirs, possible = 0-7 I tried another MacBook with Fusion, same issue happens, the cpu[0-9] dirs are not equal to /sys/devices/system/c

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-01 Thread William Tu
>> And in my /sys/devices/system/cpu, I have cpu0 and cpu1, >> kernel_max = 63 >> possible = 0-63 >> present = 0-1 > > glibc is doing > ls -d /sys/devices/system/cpu/cpu* > http://osxr.org:8080/glibc/source/sysdeps/unix/sysv/linux/getsysstats.c?v=glibc-2.14#0180 > And /sys/devices/system/cpu/possib

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-08-01 Thread Alexei Starovoitov
On Sun, Jul 31, 2016 at 08:25:12AM -0700, William Tu wrote: > >> >>num_possible_cpu == 64 > >> >>num_online_cpu == 2 == sysconf(_SC_NPROCESSORS_CONF) > > ... > >> >> To fix it, I could either > >> >> 1). declare values array based on num_possible_cpu in test_map.c, > >> >>long values[64

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-31 Thread William Tu
>> >>num_possible_cpu == 64 >> >>num_online_cpu == 2 == sysconf(_SC_NPROCESSORS_CONF) > ... >> >> To fix it, I could either >> >> 1). declare values array based on num_possible_cpu in test_map.c, >> >>long values[64]; >> >> or 2) in kernel, only copying 8*2 = 16 byte from kernel to user

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-29 Thread Alexei Starovoitov
On Fri, Jul 29, 2016 at 10:23:06PM -0700, William Tu wrote: > On Fri, Jul 29, 2016 at 5:19 PM, Daniel Borkmann wrote: > > On 07/29/2016 10:03 PM, William Tu wrote: > >> > >> I'm not using ARM. It's x86 in a VM with 2 vcpu. By printk() in kernel, I > >> got > >>num_possible_cpu == 64 > >>nu

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-29 Thread William Tu
On Fri, Jul 29, 2016 at 5:19 PM, Daniel Borkmann wrote: > On 07/29/2016 10:03 PM, William Tu wrote: >> >> Hi Daniel and Alexei, >> >> Thanks for the reply. My apology for too brief description. In short, >> in my environment, running samples/bpf/test_map always segfault under >> percpu array/hash

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-29 Thread Daniel Borkmann
On 07/29/2016 10:03 PM, William Tu wrote: Hi Daniel and Alexei, Thanks for the reply. My apology for too brief description. In short, in my environment, running samples/bpf/test_map always segfault under percpu array/hash map operations. I think it's due to stack corruption. I'm not using ARM.

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-29 Thread William Tu
Hi Daniel and Alexei, Thanks for the reply. My apology for too brief description. In short, in my environment, running samples/bpf/test_map always segfault under percpu array/hash map operations. I think it's due to stack corruption. I'm not using ARM. It's x86 in a VM with 2 vcpu. By printk() in

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-29 Thread Daniel Borkmann
On 07/29/2016 08:47 AM, Alexei Starovoitov wrote: On Thu, Jul 28, 2016 at 05:42:21PM -0700, William Tu wrote: The total size of value copy_to_user() writes to userspace should be the (current number of cpu) * (value size), instead of num_possible_cpus() * (value size). Found by samples/bpf/test

Re: [PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-28 Thread Alexei Starovoitov
On Thu, Jul 28, 2016 at 05:42:21PM -0700, William Tu wrote: > The total size of value copy_to_user() writes to userspace should > be the (current number of cpu) * (value size), instead of > num_possible_cpus() * (value size). Found by samples/bpf/test_maps.c, > which always copies 512 byte to user

[PATCH] bpf: fix size of copy_to_user in percpu map.

2016-07-28 Thread William Tu
The total size of value copy_to_user() writes to userspace should be the (current number of cpu) * (value size), instead of num_possible_cpus() * (value size). Found by samples/bpf/test_maps.c, which always copies 512 byte to userspace, crashing the userspace program stack. Signed-off-by: William