| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <873675cswf.fsf@toke.dk>
Date: Mon, 08 Jun 2020 20:30:08 +0200
From: Toke Høiland-Jørgensen <toke@...hat.com>
To: Jesper Dangaard Brouer <brouer@...hat.com>,
David Ahern <dsahern@...il.com>, bpf@...r.kernel.org,
Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Jesper Dangaard Brouer <brouer@...hat.com>, netdev@...r.kernel.org,
Daniel Borkmann <borkmann@...earbox.net>,
Andrii Nakryiko <andrii.nakryiko@...il.com>,
Lorenzo Bianconi <lorenzo@...nel.org>
Subject: Re: [PATCH bpf 2/3] bpf: devmap adjust uapi for attach bpf program
Jesper Dangaard Brouer <brouer@...hat.com> writes:
> The recent commit fbee97feed9b ("bpf: Add support to attach bpf program to a
> devmap entry"), introduced ability to attach (and run) a separate XDP
> bpf_prog for each devmap entry. A bpf_prog is added via a file-descriptor.
> As zero were a valid FD, not using the feature requires using value minus-1.
> The UAPI is extended via tail-extending struct bpf_devmap_val and using
> map->value_size to determine the feature set.
>
> This will break older userspace applications not using the bpf_prog feature.
> Consider an old userspace app that is compiled against newer kernel
> uapi/bpf.h, it will not know that it need to initialise the member
> bpf_prog.fd to minus-1. Thus, users will be forced to update source code to
> get program running on newer kernels.
>
> As previous patch changed BPF-syscall to avoid returning file descriptor
> value zero, we can remove the minus-1 checks, and have zero mean feature
> isn't used.
>
> Fixes: fbee97feed9b ("bpf: Add support to attach bpf program to a devmap entry")
> Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
> ---
> include/uapi/linux/bpf.h | 13 +++++++++++++
> kernel/bpf/devmap.c | 17 ++++-------------
> tools/include/uapi/linux/bpf.h | 5 -----
> 3 files changed, 17 insertions(+), 18 deletions(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index c65b374a5090..19684813faae 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -3761,6 +3761,19 @@ struct xdp_md {
> __u32 egress_ifindex; /* txq->dev->ifindex */
> };
>
> +/* DEVMAP map-value layout
> + *
> + * The struct data-layout of map-value is a configuration interface.
> + * New members can only be added to the end of this structure.
> + */
> +struct bpf_devmap_val {
> + __u32 ifindex; /* device index */
> + union {
> + int fd; /* prog fd on map write */
> + __u32 id; /* prog id on map read */
> + } bpf_prog;
> +};
> +
> enum sk_action {
> SK_DROP = 0,
> SK_PASS,
> diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
> index 854b09beb16b..d268a8e693cb 100644
> --- a/kernel/bpf/devmap.c
> +++ b/kernel/bpf/devmap.c
> @@ -60,15 +60,6 @@ struct xdp_dev_bulk_queue {
> unsigned int count;
> };
>
> -/* DEVMAP values */
> -struct bpf_devmap_val {
> - u32 ifindex; /* device index */
> - union {
> - int fd; /* prog fd on map write */
> - u32 id; /* prog id on map read */
> - } bpf_prog;
> -};
> -
> struct bpf_dtab_netdev {
> struct net_device *dev; /* must be first member, due to tracepoint */
> struct hlist_node index_hlist;
> @@ -618,7 +609,7 @@ static struct bpf_dtab_netdev *__dev_map_alloc_node(struct net *net,
> if (!dev->dev)
> goto err_out;
>
> - if (val->bpf_prog.fd >= 0) {
> + if (val->bpf_prog.fd > 0) {
> prog = bpf_prog_get_type_dev(val->bpf_prog.fd,
> BPF_PROG_TYPE_XDP, false);
> if (IS_ERR(prog))
> @@ -652,8 +643,8 @@ static int __dev_map_update_elem(struct net *net, struct bpf_map *map,
> void *key, void *value, u64 map_flags)
> {
> struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
> - struct bpf_devmap_val val = { .bpf_prog.fd = -1 };
> struct bpf_dtab_netdev *dev, *old_dev;
> + struct bpf_devmap_val val = {0};
nit: I prefer {} to {0} - 'git grep' indicates that {} is also the most
commonly used in kernel/bpf/
> u32 i = *(u32 *)key;
>
> if (unlikely(map_flags > BPF_EXIST))
> @@ -669,7 +660,7 @@ static int __dev_map_update_elem(struct net *net, struct bpf_map *map,
> if (!val.ifindex) {
> dev = NULL;
> /* can not specify fd if ifindex is 0 */
> - if (val.bpf_prog.fd != -1)
> + if (val.bpf_prog.fd > 0)
> return -EINVAL;
> } else {
> dev = __dev_map_alloc_node(net, dtab, &val, i);
> @@ -699,8 +690,8 @@ static int __dev_map_hash_update_elem(struct net *net, struct bpf_map *map,
> void *key, void *value, u64 map_flags)
> {
> struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
> - struct bpf_devmap_val val = { .bpf_prog.fd = -1 };
> struct bpf_dtab_netdev *dev, *old_dev;
> + struct bpf_devmap_val val = {0};
Same here.
> u32 idx = *(u32 *)key;
> unsigned long flags;
> int err = -EEXIST;
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index c65b374a5090..868e9efe9c09 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -3761,11 +3761,6 @@ struct xdp_md {
> __u32 egress_ifindex; /* txq->dev->ifindex */
> };
>
> -enum sk_action {
> - SK_DROP = 0,
> - SK_PASS,
> -};
> -
> /* user accessible metadata for SK_MSG packet hook, new fields must
> * be added to the end of this structure
> */
Powered by blists - more mailing lists