From: Matteo Croce <teknoraver@meta.com>
These kfuncs are enabled even in BPF_PROG_TYPE_TRACING, so they
should be safe also in BPF_CGROUP_* programs.
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Matteo Croce <teknoraver@meta.com>
---
kernel/bpf/helpers.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index d02ae323996b..0d1d97d968b0 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -3052,6 +3052,12 @@ static int __init kfunc_init(void)
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_DEVICE, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SYSCTL, &generic_kfunc_set);
+ ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCKOPT, &generic_kfunc_set);
ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
ARRAY_SIZE(generic_dtors),
THIS_MODULE);
--
2.45.2Il giorno gio 25 lug 2024 alle ore 02:14 <technoboy85@gmail.com> ha scritto:
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -3052,6 +3052,12 @@ static int __init kfunc_init(void)
> ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
> ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
> ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_DEVICE, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SYSCTL, &generic_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCKOPT, &generic_kfunc_set);
> ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
> ARRAY_SIZE(generic_dtors),
> THIS_MODULE);
This seems not enough, some kfuncs like bpf_cgroup_from_id are still rejected.
To fix this we need also this chunk:
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -8309,7 +8319,11 @@ static int bpf_prog_type_to_kfunc_hook(enum
bpf_prog_type prog_type)
case BPF_PROG_TYPE_SYSCALL:
return BTF_KFUNC_HOOK_SYSCALL;
case BPF_PROG_TYPE_CGROUP_SKB:
+ case BPF_PROG_TYPE_CGROUP_SOCK:
+ case BPF_PROG_TYPE_CGROUP_DEVICE:
case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+ case BPF_PROG_TYPE_CGROUP_SYSCTL:
+ case BPF_PROG_TYPE_CGROUP_SOCKOPT:
return BTF_KFUNC_HOOK_CGROUP_SKB;
case BPF_PROG_TYPE_SCHED_ACT:
return BTF_KFUNC_HOOK_SCHED_ACT;
but even with this it won't work, because
bpf_prog_type_to_kfunc_hook() aliases many program types with a single
hook, and btf_kfunc_id_set_contains() will fail to check if the kfunc
is in the set.
One solution could be to extend the btf_kfunc_hook enum with an entry
for every CGROUP program type, but a thing I wanted to avoid is to let
this enum proliferate in this way.
I wish to group all the CGROUP_ program types into a single hook, and
perhaps drop the "SKB" in "BTF_KFUNC_HOOK_CGROUP_SKB" which will have
no meaning anymore.
Ideas?
--
Matteo Croce
perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay
On Mon, Aug 12, 2024 at 9:49 AM Matteo Croce <technoboy85@gmail.com> wrote:
>
> Il giorno gio 25 lug 2024 alle ore 02:14 <technoboy85@gmail.com> ha scritto:
> > --- a/kernel/bpf/helpers.c
> > +++ b/kernel/bpf/helpers.c
> > @@ -3052,6 +3052,12 @@ static int __init kfunc_init(void)
> > ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &generic_kfunc_set);
> > ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_STRUCT_OPS, &generic_kfunc_set);
> > ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_DEVICE, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SYSCTL, &generic_kfunc_set);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCKOPT, &generic_kfunc_set);
> > ret = ret ?: register_btf_id_dtor_kfuncs(generic_dtors,
> > ARRAY_SIZE(generic_dtors),
> > THIS_MODULE);
>
> This seems not enough, some kfuncs like bpf_cgroup_from_id are still rejected.
> To fix this we need also this chunk:
>
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -8309,7 +8319,11 @@ static int bpf_prog_type_to_kfunc_hook(enum
> bpf_prog_type prog_type)
> case BPF_PROG_TYPE_SYSCALL:
> return BTF_KFUNC_HOOK_SYSCALL;
> case BPF_PROG_TYPE_CGROUP_SKB:
> + case BPF_PROG_TYPE_CGROUP_SOCK:
> + case BPF_PROG_TYPE_CGROUP_DEVICE:
> case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
> + case BPF_PROG_TYPE_CGROUP_SYSCTL:
> + case BPF_PROG_TYPE_CGROUP_SOCKOPT:
> return BTF_KFUNC_HOOK_CGROUP_SKB;
> case BPF_PROG_TYPE_SCHED_ACT:
> return BTF_KFUNC_HOOK_SCHED_ACT;
>
> but even with this it won't work, because
> bpf_prog_type_to_kfunc_hook() aliases many program types with a single
> hook, and btf_kfunc_id_set_contains() will fail to check if the kfunc
> is in the set.
>
> One solution could be to extend the btf_kfunc_hook enum with an entry
> for every CGROUP program type, but a thing I wanted to avoid is to let
> this enum proliferate in this way.
> I wish to group all the CGROUP_ program types into a single hook, and
> perhaps drop the "SKB" in "BTF_KFUNC_HOOK_CGROUP_SKB" which will have
> no meaning anymore.
>
> Ideas?
Given BPF_PROG_TYPE_CGROUP_SKB and BPF_PROG_TYPE_CGROUP_SOCK_ADDR are
already grouped into the same hook type, and
bpf_sock_addr_set_sun_path() is meant to be enabled for
BPF_PROG_TYPE_CGROUP_SOCK_ADDR (but really it's enabled for
BPF_PROG_TYPE_CGROUP_SKB as well), I guess it's fine to just have one
CGROUP hook type for all those cgroup-related program types and just
rely on BTF type matching logic.
I'd say that register_btf_kfunc_id_set() should just accept enum
bpf_kfunc_hook instead of enum bpf_prog_type (I don't see where we
remember or use prog_type beyond just translating that to
bpf_kfunc_hook), but that can be left for follow up clean ups.
>
> --
> Matteo Croce
>
> perl -e 'for($t=0;;$t++){print chr($t*($t>>8|$t>>13)&255)}' |aplay
© 2016 - 2025 Red Hat, Inc.