From: Jakub Kicinski <jakub.kicinski@netronome.com>
To: "Toke Høiland-Jørgensen" <toke@redhat.com>
Cc: David Miller <davem@davemloft.net>,
netdev@vger.kernel.org,
Jesper Dangaard Brouer <brouer@redhat.com>,
Daniel Borkmann <daniel@iogearbox.net>,
Alexei Starovoitov <ast@kernel.org>
Subject: Re: [PATCH net-next 1/2] xdp: Always use a devmap for XDP_REDIRECT to a device
Date: Thu, 21 Feb 2019 16:36:27 -0800 [thread overview]
Message-ID: <20190221163627.7b8aa2ce@cakuba.netronome.com> (raw)
In-Reply-To: <155075021399.13610.12521373406832889226.stgit@alrua-x1>
On Thu, 21 Feb 2019 12:56:54 +0100, Toke Høiland-Jørgensen wrote:
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b63bc77af2d1..629661db36ee 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -7527,6 +7527,12 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
> prog->dst_needed = 1;
> if (insn->imm == BPF_FUNC_get_prandom_u32)
> bpf_user_rnd_init_once();
> + if (insn->imm == BPF_FUNC_redirect) {
> + int err = dev_map_alloc_default_map();
> +
> + if (err)
> + return err;
> + }
> if (insn->imm == BPF_FUNC_override_return)
> prog->kprobe_override = 1;
> if (insn->imm == BPF_FUNC_tail_call) {
> +int dev_map_alloc_default_map(void)
> +{
> + struct net *net = current->nsproxy->net_ns;
> + struct bpf_dtab *dtab, *old_dtab;
> + struct net_device *netdev;
> + union bpf_attr attr = {};
> + u32 idx;
> + int err;
BPF programs don't obey by netns boundaries. The fact the program is
verified in one ns doesn't mean this is the only ns it will be used in :(
Meaning if any program is using the redirect map you may need a secret
map in every ns.. no?
next prev parent reply other threads:[~2019-02-22 0:36 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-21 11:56 [PATCH net-next 1/2] xdp: Always use a devmap for XDP_REDIRECT to a device Toke Høiland-Jørgensen
2019-02-21 11:56 ` [PATCH net-next 2/2] xdp: Add devmap_idx map type for looking up devices by ifindex Toke Høiland-Jørgensen
2019-02-21 15:23 ` Jesper Dangaard Brouer
2019-02-21 15:50 ` Toke Høiland-Jørgensen
2019-02-21 21:49 ` Jakub Kicinski
2019-02-21 23:02 ` Toke Høiland-Jørgensen
2019-02-22 0:32 ` Jakub Kicinski
2019-02-22 9:47 ` Toke Høiland-Jørgensen
2019-02-22 21:30 ` Jakub Kicinski
2019-02-23 11:52 ` Toke Høiland-Jørgensen
2019-02-23 23:19 ` kbuild test robot
2019-02-23 23:28 ` kbuild test robot
2019-02-21 15:19 ` [PATCH net-next 1/2] xdp: Always use a devmap for XDP_REDIRECT to a device Jesper Dangaard Brouer
2019-02-21 15:52 ` Toke Høiland-Jørgensen
2019-02-22 0:36 ` Jakub Kicinski [this message]
2019-02-22 10:13 ` Toke Høiland-Jørgensen
2019-02-22 21:37 ` Jakub Kicinski
2019-02-23 10:43 ` Jesper Dangaard Brouer
2019-02-23 12:11 ` Toke Høiland-Jørgensen
2019-02-25 18:47 ` Jakub Kicinski
2019-02-26 11:00 ` Toke Høiland-Jørgensen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190221163627.7b8aa2ce@cakuba.netronome.com \
--to=jakub.kicinski@netronome.com \
--cc=ast@kernel.org \
--cc=brouer@redhat.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.