| Message ID | 20190424160951.45865-1-sdf@google.com |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next,v2,1/2] bpf: support BPF_PROG_QUERY for BPF_FLOW_DISSECTOR attach_type | expand |
On Wed, Apr 24, 2019 at 6:09 PM Stanislav Fomichev <sdf@google.com> wrote: > target_fd is target namespace. If there is a flow dissector BPF program > attached to that namespace, its (single) id is returned. > > v2: > * don't sleep in rcu critical section (Jakub Kicinski) > * check input prog_cnt (exit early) > > Signed-off-by: Stanislav Fomichev <sdf@google.com> [...] > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > + union bpf_attr __user *uattr) > +{ [...] > + net = get_net_ns_by_fd(attr->query.target_fd); > + if (IS_ERR(net)) > + return PTR_ERR(net); At this point, you're holding a refcounted reference to `net`. It looks like that reference is never dropped? > + > + rcu_read_lock(); > + attached = rcu_dereference(net->flow_dissector_prog); > + if (attached) { > + prog_cnt = 1; > + prog_id = attached->aux->id; > + } > + rcu_read_unlock(); > + > + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) > + return -EFAULT; [...] > +}
On 04/24, Jann Horn wrote: > On Wed, Apr 24, 2019 at 6:09 PM Stanislav Fomichev <sdf@google.com> wrote: > > target_fd is target namespace. If there is a flow dissector BPF program > > attached to that namespace, its (single) id is returned. > > > > v2: > > * don't sleep in rcu critical section (Jakub Kicinski) > > * check input prog_cnt (exit early) > > > > Signed-off-by: Stanislav Fomichev <sdf@google.com> > [...] > > +int skb_flow_dissector_prog_query(const union bpf_attr *attr, > > + union bpf_attr __user *uattr) > > +{ > [...] > > + net = get_net_ns_by_fd(attr->query.target_fd); > > + if (IS_ERR(net)) > > + return PTR_ERR(net); > > At this point, you're holding a refcounted reference to `net`. It > looks like that reference is never dropped? Ah, indeed, put_net is missing, thanks! > > + > > + rcu_read_lock(); > > + attached = rcu_dereference(net->flow_dissector_prog); > > + if (attached) { > > + prog_cnt = 1; > > + prog_id = attached->aux->id; > > + } > > + rcu_read_unlock(); > > + > > + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) > > + return -EFAULT; > [...] > > +}
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 998256c2820b..9f499c0ac53b 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1258,11 +1258,19 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, unsigned int key_count); #ifdef CONFIG_NET +int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr); int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog); int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr); #else +static int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr) +{ + return -EOPNOTSUPP; +} + static inline int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog) { diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 92c9b8a32b50..b0de49598341 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2009,6 +2009,8 @@ static int bpf_prog_query(const union bpf_attr *attr, break; case BPF_LIRC_MODE2: return lirc_prog_query(attr, uattr); + case BPF_FLOW_DISSECTOR: + return skb_flow_dissector_prog_query(attr, uattr); default: return -EINVAL; } diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index fac712cee9d5..12b92c7d1eae 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -65,6 +65,43 @@ void skb_flow_dissector_init(struct flow_dissector *flow_dissector, } EXPORT_SYMBOL(skb_flow_dissector_init); +int skb_flow_dissector_prog_query(const union bpf_attr *attr, + union bpf_attr __user *uattr) +{ + __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids); + u32 prog_id, prog_cnt = 0, flags = 0; + struct bpf_prog *attached; + struct net *net; + + if (attr->query.query_flags) + return -EINVAL; + + net = get_net_ns_by_fd(attr->query.target_fd); + if (IS_ERR(net)) + return PTR_ERR(net); + + rcu_read_lock(); + attached = rcu_dereference(net->flow_dissector_prog); + if (attached) { + prog_cnt = 1; + prog_id = attached->aux->id; + } + rcu_read_unlock(); + + if (copy_to_user(&uattr->query.attach_flags, &flags, sizeof(flags))) + return -EFAULT; + if (copy_to_user(&uattr->query.prog_cnt, &prog_cnt, sizeof(prog_cnt))) + return -EFAULT; + + if (!attr->query.prog_cnt || !prog_ids || !prog_cnt) + return 0; + + if (copy_to_user(prog_ids, &prog_id, sizeof(u32))) + return -EFAULT; + + return 0; +} + int skb_flow_dissector_bpf_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog) {
target_fd is target namespace. If there is a flow dissector BPF program attached to that namespace, its (single) id is returned. v2: * don't sleep in rcu critical section (Jakub Kicinski) * check input prog_cnt (exit early) Signed-off-by: Stanislav Fomichev <sdf@google.com> --- include/linux/skbuff.h | 8 ++++++++ kernel/bpf/syscall.c | 2 ++ net/core/flow_dissector.c | 37 +++++++++++++++++++++++++++++++++++++ 3 files changed, 47 insertions(+)