linux-kernel - Re: [PATCH bpf-next] bpf: Support default .validate() and .update() behavior for struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 11 Aug 2023 16:12:52 -0700
From:   Kui-Feng Lee <sinquersw@...il.com>
To:     Martin KaFai Lau <martin.lau@...ux.dev>,
        David Vernet <void@...ifault.com>
Cc:     bpf@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        andrii@...nel.org, song@...nel.org, yhs@...com,
        john.fastabend@...il.com, kpsingh@...nel.org, haoluo@...gle.com,
        jolsa@...nel.org, linux-kernel@...r.kernel.org,
        kernel-team@...a.com, tj@...nel.org, clm@...a.com,
        thinker.li@...il.com, Stanislav Fomichev <sdf@...gle.com>
Subject: Re: [PATCH bpf-next] bpf: Support default .validate() and .update()
 behavior for struct_ops links



On 8/11/23 15:49, Martin KaFai Lau wrote:
> On 8/11/23 1:19 PM, David Vernet wrote:
>> On Fri, Aug 11, 2023 at 10:35:03AM -0700, Martin KaFai Lau wrote:
>>> On 8/10/23 4:15 PM, Stanislav Fomichev wrote:
>>>> On 08/10, David Vernet wrote:
>>>>> On Thu, Aug 10, 2023 at 03:46:18PM -0700, Stanislav Fomichev wrote:
>>>>>> On 08/10, David Vernet wrote:
>>>>>>> Currently, if a struct_ops map is loaded with BPF_F_LINK, it must 
>>>>>>> also
>>>>>>> define the .validate() and .update() callbacks in its corresponding
>>>>>>> struct bpf_struct_ops in the kernel. Enabling struct_ops link is 
>>>>>>> useful
>>>>>>> in its own right to ensure that the map is unloaded if an 
>>>>>>> application
>>>>>>> crashes. For example, with sched_ext, we want to automatically 
>>>>>>> unload
>>>>>>> the host-wide scheduler if the application crashes. We would likely
>>>>>>> never support updating elements of a sched_ext struct_ops map, so 
>>>>>>> we'd
>>>>>>> have to implement these callbacks showing that they _can't_ support
>>>>>>> element updates just to benefit from the basic lifetime 
>>>>>>> management of
>>>>>>> struct_ops links.
>>>>>>>
>>>>>>> Let's enable struct_ops maps to work with BPF_F_LINK even if they
>>>>>>> haven't defined these callbacks, by assuming that a struct_ops map
>>>>>>> element cannot be updated by default.
>>>>>>
>>>>>> Any reason this is not part of sched_ext series? As you mention,
>>>>>> we don't seem to have such users in the three?
>>>>>
>>>>> Hi Stanislav,
>>>>>
>>>>> The sched_ext series [0] implements these callbacks. See
>>>>> bpf_scx_update() and bpf_scx_validate().
>>>>>
>>>>> [0]: 
>>>>> https://lore.kernel.org/all/20230711011412.100319-13-tj@kernel.org/
>>>>>
>>>>> We could add this into that series and remove those callbacks, but 
>>>>> this
>>>>> patch is fixing a UX / API issue with struct_ops links that's not 
>>>>> really
>>>>> relevant to sched_ext. I don't think there's any reason to couple
>>>>> updating struct_ops map elements with allowing the kernel to manage 
>>>>> the
>>>>> lifetime of struct_ops maps -- just because we only have 1 (non-test)
>>>
>>> Agree the link-update does not necessarily couple with link-creation, so
>>> removing 'link' update function enforcement is ok. The intention was to
>>> avoid the struct_ops link inconsistent experience (one struct_ops link
>>> support update and another struct_ops link does not) because 
>>> consistency was
>>> one of the reason for the true kernel backed link support that 
>>> Kui-Feng did.
>>> tcp-cc is the only one for now in struct_ops and it can support 
>>> update, so
>>> the enforcement is here. I can see Stan's point that removing it now 
>>> looks
>>> immature before a struct_ops landed in the kernel showing it does not 
>>> make
>>> sense or very hard to support 'link' update. However, the scx patch 
>>> set has
>>> shown this point, so I think it is good enough.
>>
>> Sorry for sending v2 of the patch a bit prematurely. Should have let you
>> weigh in first.
>>
>>> For 'validate', it is not related a 'link' update. It is for the 
>>> struct_ops
>>> 'map' update. If the loaded struct_ops map is invalid, it will end up 
>>> having
>>> a useless struct_ops map and no link can be created from it. I can 
>>> see some
>>
>> To be honest I'm actually not sure I understand why .validate() is only
>> called for when BPF_F_LINK is specified. Is it because it could break
> 
> Regardless '.validate' must be enforced or not, the ->validate() should 
> be called for the non BPF_F_LINK case also during map update. This 
> should be fixed.

For the case of the TCP congestion control, its validation function is
called by the implementations of ->validate() and ->reg(). I mean it
expects ->reg() to do validation as well.

... SKIP ...