netdev - Re: [PATCH bpf-next v2 10/20] net: bpf: add netlink and ipv6_route bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 5 May 2020 22:21:45 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Yonghong Song <yhs@...com>
Cc:     Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>
Subject: Re: [PATCH bpf-next v2 10/20] net: bpf: add netlink and ipv6_route
 bpf_iter targets

On Sun, May 3, 2020 at 11:29 PM Yonghong Song <yhs@...com> wrote:
>
> This patch added netlink and ipv6_route targets, using
> the same seq_ops (except show() and minor changes for stop())
> for /proc/net/{netlink,ipv6_route}.
>
> The net namespace for these targets are the current net
> namespace at file open stage, similar to
> /proc/net/{netlink,ipv6_route} reference counting
> the net namespace at seq_file open stage.
>
> Since module is not supported for now, ipv6_route is
> supported only if the IPV6 is built-in, i.e., not compiled
> as a module. The restriction can be lifted once module
> is properly supported for bpf_iter.
>
> Signed-off-by: Yonghong Song <yhs@...com>
> ---
>  fs/proc/proc_net.c       | 19 +++++++++
>  include/linux/proc_fs.h  |  3 ++
>  net/ipv6/ip6_fib.c       | 65 +++++++++++++++++++++++++++++-
>  net/ipv6/route.c         | 27 +++++++++++++
>  net/netlink/af_netlink.c | 87 +++++++++++++++++++++++++++++++++++++++-
>  5 files changed, 197 insertions(+), 4 deletions(-)
>

[...]

>  int __init ip6_route_init(void)
>  {
>         int ret;
> @@ -6455,6 +6474,14 @@ int __init ip6_route_init(void)
>         if (ret)
>                 goto out_register_late_subsys;
>
> +#if IS_BUILTIN(CONFIG_IPV6)
> +#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_PROC_FS)
> +       ret = bpf_iter_register();
> +       if (ret)
> +               goto out_register_late_subsys;

Seems like bpf_iter infra is missing unregistering API.
ip6_route_init(), if fails, undoes all the registrations, so probably
should also unregister ipv6_route target as well?

> +#endif
> +#endif
> +
>         for_each_possible_cpu(cpu) {
>                 struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
>

[...]

> +static void netlink_seq_stop(struct seq_file *seq, void *v)
> +{
> +       struct bpf_iter_meta meta;
> +       struct bpf_prog *prog;
> +
> +       if (!v) {
> +               meta.seq = seq;
> +               prog = bpf_iter_get_info(&meta, true);
> +               if (prog)
> +                       netlink_prog_seq_show(prog, &meta, v);

nit: netlink_prog_seq_show() can return failure (from BPF program),
but you are not returning it. Given seq_file's stop is not supposed to
fail, you can explicitly cast result to (void)? I think it's done in
few other places in BPF code, when return result is explicitly
ignored.


> +       }
> +
> +       netlink_native_seq_stop(seq, v);
> +}
> +#else

[...]