From: Nicolas Rybowski <nicolas.rybowski at tessares.net> To: mptcp at lists.01.org Subject: [MPTCP] [PATCH bpf-next 2/3] mptcp: attach subflow socket to parent cgroup Date: Fri, 21 Aug 2020 17:15:40 +0200 [thread overview] Message-ID: <20200821151544.1211989-3-nicolas.rybowski@tessares.net> (raw) In-Reply-To: 20200821151544.1211989-1-nicolas.rybowski@tessares.net [-- Attachment #1: Type: text/plain, Size: 2524 bytes --] It has been observed that the kernel sockets created for the subflows (except the first one) are not in the same cgroup as their parents. That's because the additional subflows are created by kernel workers. This is a problem with eBPF programs attached to the parent's cgroup won't be executed for the children. But also with any other features of CGroup linked to a sk. This patch fixes this behaviour. As the subflow sockets are created by the kernel, we can't use 'mem_cgroup_sk_alloc' because of the current context being the one of the kworker. This is why we have to do low level memcg manipulation, if required. Suggested-by: Matthieu Baerts <matthieu.baerts(a)tessares.net> Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Acked-by: Matthieu Baerts <matthieu.baerts(a)tessares.net> Reviewed-by: Mat Martineau <mathew.j.martineau(a)linux.intel.com> Signed-off-by: Nicolas Rybowski <nicolas.rybowski(a)tessares.net> --- net/mptcp/subflow.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index e8cac2655c82..535a3f9f8cfc 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1130,6 +1130,30 @@ int __mptcp_subflow_connect(struct sock *sk, int ifindex, return err; } +static void mptcp_attach_cgroup(struct sock *parent, struct sock *child) +{ +#ifdef CONFIG_SOCK_CGROUP_DATA + struct sock_cgroup_data *parent_skcd = &parent->sk_cgrp_data, + *child_skcd = &child->sk_cgrp_data; + + /* only the additional subflows created by kworkers have to be modified */ + if (cgroup_id(sock_cgroup_ptr(parent_skcd)) != + cgroup_id(sock_cgroup_ptr(child_skcd))) { +#ifdef CONFIG_MEMCG + struct mem_cgroup *memcg = parent->sk_memcg; + + mem_cgroup_sk_free(child); + if (memcg && css_tryget(&memcg->css)) + child->sk_memcg = memcg; +#endif /* CONFIG_MEMCG */ + + cgroup_sk_free(child_skcd); + *child_skcd = *parent_skcd; + cgroup_sk_clone(child_skcd); + } +#endif /* CONFIG_SOCK_CGROUP_DATA */ +} + int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) { struct mptcp_subflow_context *subflow; @@ -1150,6 +1174,9 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) lock_sock(sf->sk); + /* the newly created socket has to be in the same cgroup as its parent */ + mptcp_attach_cgroup(sk, sf->sk); + /* kernel sockets do not by default acquire net ref, but TCP timer * needs it. */ -- 2.28.0
WARNING: multiple messages have this Message-ID (diff)
From: Nicolas Rybowski <nicolas.rybowski@tessares.net> To: Mat Martineau <mathew.j.martineau@linux.intel.com>, Matthieu Baerts <matthieu.baerts@tessares.net>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Alexei Starovoitov <ast@kernel.org>, Daniel Borkmann <daniel@iogearbox.net>, Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>, Andrii Nakryiko <andriin@fb.com>, John Fastabend <john.fastabend@gmail.com>, KP Singh <kpsingh@chromium.org> Cc: Nicolas Rybowski <nicolas.rybowski@tessares.net>, Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org, mptcp@lists.01.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next 2/3] mptcp: attach subflow socket to parent cgroup Date: Fri, 21 Aug 2020 17:15:40 +0200 [thread overview] Message-ID: <20200821151544.1211989-3-nicolas.rybowski@tessares.net> (raw) In-Reply-To: <20200821151544.1211989-1-nicolas.rybowski@tessares.net> It has been observed that the kernel sockets created for the subflows (except the first one) are not in the same cgroup as their parents. That's because the additional subflows are created by kernel workers. This is a problem with eBPF programs attached to the parent's cgroup won't be executed for the children. But also with any other features of CGroup linked to a sk. This patch fixes this behaviour. As the subflow sockets are created by the kernel, we can't use 'mem_cgroup_sk_alloc' because of the current context being the one of the kworker. This is why we have to do low level memcg manipulation, if required. Suggested-by: Matthieu Baerts <matthieu.baerts@tessares.net> Suggested-by: Paolo Abeni <pabeni@redhat.com> Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net> Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: Nicolas Rybowski <nicolas.rybowski@tessares.net> --- net/mptcp/subflow.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index e8cac2655c82..535a3f9f8cfc 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1130,6 +1130,30 @@ int __mptcp_subflow_connect(struct sock *sk, int ifindex, return err; } +static void mptcp_attach_cgroup(struct sock *parent, struct sock *child) +{ +#ifdef CONFIG_SOCK_CGROUP_DATA + struct sock_cgroup_data *parent_skcd = &parent->sk_cgrp_data, + *child_skcd = &child->sk_cgrp_data; + + /* only the additional subflows created by kworkers have to be modified */ + if (cgroup_id(sock_cgroup_ptr(parent_skcd)) != + cgroup_id(sock_cgroup_ptr(child_skcd))) { +#ifdef CONFIG_MEMCG + struct mem_cgroup *memcg = parent->sk_memcg; + + mem_cgroup_sk_free(child); + if (memcg && css_tryget(&memcg->css)) + child->sk_memcg = memcg; +#endif /* CONFIG_MEMCG */ + + cgroup_sk_free(child_skcd); + *child_skcd = *parent_skcd; + cgroup_sk_clone(child_skcd); + } +#endif /* CONFIG_SOCK_CGROUP_DATA */ +} + int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) { struct mptcp_subflow_context *subflow; @@ -1150,6 +1174,9 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock) lock_sock(sf->sk); + /* the newly created socket has to be in the same cgroup as its parent */ + mptcp_attach_cgroup(sk, sf->sk); + /* kernel sockets do not by default acquire net ref, but TCP timer * needs it. */ -- 2.28.0
next reply other threads:[~2020-08-21 15:15 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-08-21 15:15 Nicolas Rybowski [this message] 2020-08-21 15:15 ` [PATCH bpf-next 2/3] mptcp: attach subflow socket to parent cgroup Nicolas Rybowski -- strict thread matches above, loose matches on Subject: below -- 2020-08-27 11:54 [MPTCP] Re: [PATCH bpf-next 0/3] bpf: add MPTCP subflow support Nicolas Rybowski 2020-08-27 11:54 ` Nicolas Rybowski 2020-08-26 19:12 [MPTCP] " Alexei Starovoitov 2020-08-26 19:12 ` Alexei Starovoitov 2020-08-25 18:55 [MPTCP] " Nicolas Rybowski 2020-08-25 18:55 ` Nicolas Rybowski 2020-08-24 22:01 [MPTCP] " Alexei Starovoitov 2020-08-24 22:01 ` Alexei Starovoitov 2020-08-21 15:15 [MPTCP] [PATCH bpf-next 3/3] bpf: add 'bpf_mptcp_sock' structure and helper Nicolas Rybowski 2020-08-21 15:15 ` Nicolas Rybowski 2020-08-21 15:15 [MPTCP] [PATCH bpf-next 0/3] bpf: add MPTCP subflow support Nicolas Rybowski 2020-08-21 15:15 ` Nicolas Rybowski 2020-08-21 15:15 ` [PATCH bpf-next 1/3] bpf: expose is_mptcp flag to bpf_tcp_sock Nicolas Rybowski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200821151544.1211989-3-nicolas.rybowski@tessares.net \ --to=unknown@example.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.