linux-kernel - Re: [PATCH bpf-next v3 1/2] bpf: enable generic kfuncs for BPF_CGROUP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFnufp1jxnjL2apUwxWKkNzS5QKpDXYTWPnVLn-VQyZazFujCg@mail.gmail.com>
Date: Mon, 12 Aug 2024 18:48:47 +0200
From: Matteo Croce <technoboy85@...il.com>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>, Alexei Starovoitov <ast@...nel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Steven Rostedt <rostedt@...dmis.org>, 
	Masami Hiramatsu <mhiramat@...nel.org>, bpf@...r.kernel.org, 
	linux-trace-kernel@...r.kernel.org
Cc: linux-kernel@...r.kernel.org, Matteo Croce <teknoraver@...a.com>, 
	Andrii Nakryiko <andrii@...nel.org>
Subject: Re: [PATCH bpf-next v3 1/2] bpf: enable generic kfuncs for
 BPF_CGROUP_* programs

Il giorno gio 25 lug 2024 alle ore 02:14 <technoboy85@...il.com> ha scritto:
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3052,6 +3052,12 @@ static int __init kfunc_init(void)
>         ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
>         ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
>         ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_DEVICE, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SYSCTL, &generic_kfunc_set);
> +       ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCKOPT, &generic_kfunc_set);
>         ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
>                                                   ARRAY_SIZE(generic_dtors),
>                                                   THIS_MODULE);

This seems not enough, some kfuncs like bpf_cgroup_from_id are still rejected.
To fix this we need also this chunk:

--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8309,7 +8319,11 @@ static int bpf_prog_type_to_kfunc_hook(enum
bpf_prog_type prog_type)
        case BPF_PROG_TYPE_SYSCALL:
                return BTF_KFUNC_HOOK_SYSCALL;
        case BPF_PROG_TYPE_CGROUP_SKB:
+       case BPF_PROG_TYPE_CGROUP_SOCK:
+       case BPF_PROG_TYPE_CGROUP_DEVICE:
        case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+       case BPF_PROG_TYPE_CGROUP_SYSCTL:
+       case BPF_PROG_TYPE_CGROUP_SOCKOPT:
                return BTF_KFUNC_HOOK_CGROUP_SKB;
        case BPF_PROG_TYPE_SCHED_ACT:
                return BTF_KFUNC_HOOK_SCHED_ACT;

but even with this it won't work, because
bpf_prog_type_to_kfunc_hook() aliases many program types with a single
hook, and btf_kfunc_id_set_contains() will fail to check if the kfunc
is in the set.

One solution could be to extend the btf_kfunc_hook enum with an entry
for every CGROUP program type, but a thing I wanted to avoid is to let
this enum proliferate in this way.
I wish to group all the CGROUP_ program types into a single hook, and
perhaps drop the "SKB" in "BTF_KFUNC_HOOK_CGROUP_SKB" which will have
no meaning anymore.

Ideas?

-- 
Matteo Croce

perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay