-
Notifications
You must be signed in to change notification settings - Fork 224
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[netebpfext] Add per-provider WFP handles to avoid improper use from parallel invocations #3866
base: main
Are you sure you want to change the base?
Conversation
@@ -643,6 +662,26 @@ net_ebpf_ext_uninitialize_ndis_handles() | |||
} | |||
} | |||
|
|||
NTSTATUS | |||
net_ebpf_extension_open_wfp_engine_handle(HANDLE* wfp_engine_handle) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SAL _Out_
} | ||
|
||
NTSTATUS | ||
net_ebpf_extension_close_wfp_engine_handle(HANDLE wfp_engine_handle) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add SAL _In_
because HANDLE is technically a pointer. There are many precedence of _In_ Handle
elsewhere in the project.
@@ -222,6 +236,11 @@ net_ebpf_ext_bind_unregister_providers() | |||
net_ebpf_extension_program_info_provider_unregister(_ebpf_bind_program_info_provider_context); | |||
_ebpf_bind_program_info_provider_context = NULL; | |||
} | |||
if (_net_ebpf_extension_bind_wfp_engine_handle) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit != NULL
@@ -19,6 +19,8 @@ typedef struct _bind_context_header | |||
// WFP filter related globals for bind hook. | |||
// | |||
|
|||
static HANDLE _net_ebpf_extension_bind_wfp_engine_handle = NULL; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider storing the engine handle in net_ebpf_extension_wfp_filter_context_t
and opening it inside net_ebpf_extension_wfp_filter_context_create
.
Description
Issue:
Our KM stress tests revealed an issue in our netebpfext code. There is a single global WFP handle, but multiple threads could use this at the same time (such as two programs attaching in parallel), leading to errors in the WFP APIs.
Fix:
Closes #3607
Testing
Existing tests validate this functionality.
Documentation
None.
Installation
None.