linux-kernel - Re: [PATCH v3] cgroup/bpf: fast path skb BPF filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 Dec 2021 17:38:11 +0000
From:   Pavel Begunkov <asml.silence@...il.com>
To:     Jakub Kicinski <kuba@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>
Cc:     netdev@...r.kernel.org, bpf@...r.kernel.org,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] cgroup/bpf: fast path skb BPF filtering

On 12/15/21 16:40, Jakub Kicinski wrote:
> On Wed, 15 Dec 2021 14:49:18 +0000 Pavel Begunkov wrote:
>> +static inline bool
>> +__cgroup_bpf_prog_array_is_empty(struct cgroup_bpf *cgrp_bpf,
>> +				 enum cgroup_bpf_attach_type type)
>> +{
>> +	struct bpf_prog_array *array = rcu_access_pointer(cgrp_bpf->effective[type]);
>> +
>> +	return array == &bpf_empty_prog_array.hdr;
>> +}
>> +
>> +#define CGROUP_BPF_TYPE_ENABLED(sk, atype)				       \
>> +({									       \
>> +	struct cgroup *__cgrp = sock_cgroup_ptr(&(sk)->sk_cgrp_data);	       \
>> +									       \
>> +	!__cgroup_bpf_prog_array_is_empty(&__cgrp->bpf, (atype));	       \
>> +})
>> +
> 
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index e7a163a3146b..0d2195c6fb2a 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1161,6 +1161,19 @@ struct bpf_prog_array {
>>   	struct bpf_prog_array_item items[];
>>   };
>>   
>> +struct bpf_empty_prog_array {
>> +	struct bpf_prog_array hdr;
>> +	struct bpf_prog *null_prog;
>> +};
>> +
>> +/* to avoid allocating empty bpf_prog_array for cgroups that
>> + * don't have bpf program attached use one global 'bpf_empty_prog_array'
>> + * It will not be modified the caller of bpf_prog_array_alloc()
>> + * (since caller requested prog_cnt == 0)
>> + * that pointer should be 'freed' by bpf_prog_array_free()
>> + */
>> +extern struct bpf_empty_prog_array bpf_empty_prog_array;
> 
> mumble mumble, this adds more "fun" dependencies [1] Maybe I'm going

Header dependencies? It's declared right after struct bpf_prog_array,
and the other member is a pointer, so not sure what can go wrong.


> about this all wrong, maybe I should be pulling out struct cgroup_bpf
> so that cgroup.h does not need bpf-cgroup, not breaking bpf <-> bpf-cgroup.
> Alexei, WDYT?
> 
> [1] https://lore.kernel.org/all/20211215061916.715513-2-kuba@kernel.org/
> 

-- 
Pavel Begunkov