* [PATCH bpf-next v2 0/8] Implement task_local_storage
@ 2020-11-03 15:31 KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 1/8] bpf: Implement task local storage KP Singh
` (7 more replies)
0 siblings, 8 replies; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
# v1 -> v2
- Updated the refcounting for task_struct and simplified conversion
of fd -> struct pid.
- Some fixes suggested by Martin and Andrii, notably:
* long return type for the bpf_task_storage_delete helper (update
for bpf_inode_storage_delete will be sent separately).
* Remove extra nullness check to task_storage_ptr in map syscall
ops.
* Changed the argument signature of the BPF helpers to use
task_struct pointer in uapi headers.
* Remove unnecessary verifier logic for the bpf_get_current_task_btf
helper.
* Split the changes for bpftool and libbpf.
- Exercised syscall operations for local storage (kept a simpler verison
in test_local_storage.c, the eventual goal will be to update
sk_storage_map.c for all local storage types).
- Formatting fixes + Rebase.
We already have socket and inode local storage since [1]
This patch series:
* Implements bpf_local_storage for task_struct.
* Implements the bpf_get_current_task_btf helper which returns a BTF
pointer to the current task. Not only is this generally cleaner
(reading from the task_struct currently requires BPF_CORE_READ), it
also allows the BTF pointer to be used in task_local_storage helpers.
* In order to implement this helper, a RET_PTR_TO_BTF_ID is introduced
which works similar to RET_PTR_TO_BTF_ID_OR_NULL but does not require
a nullness check.
* Implements a detection in selftests which uses the
task local storage to deny a running executable from unlinking itself.
[1]: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=f836a56e84ffc9f1a1cd73f77e10404ca46a4616
KP Singh (8):
bpf: Implement task local storage
libbpf: Add support for task local storage
bpftool: Add support for task local storage
bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID
bpf: Fix tests for local_storage
bpf: Update selftests for local_storage to use vmlinux.h
bpf: Add tests for task_local_storage
bpf: Exercise syscall operations for inode and sk storage
include/linux/bpf.h | 1 +
include/linux/bpf_lsm.h | 23 ++
include/linux/bpf_types.h | 1 +
include/uapi/linux/bpf.h | 48 +++
kernel/bpf/Makefile | 1 +
kernel/bpf/bpf_lsm.c | 4 +
kernel/bpf/bpf_task_storage.c | 313 ++++++++++++++++++
kernel/bpf/syscall.c | 3 +-
kernel/bpf/verifier.c | 17 +-
kernel/trace/bpf_trace.c | 16 +
security/bpf/hooks.c | 2 +
.../bpf/bpftool/Documentation/bpftool-map.rst | 3 +-
tools/bpf/bpftool/bash-completion/bpftool | 2 +-
tools/bpf/bpftool/map.c | 4 +-
tools/include/uapi/linux/bpf.h | 48 +++
tools/lib/bpf/libbpf_probes.c | 2 +
.../bpf/prog_tests/test_local_storage.c | 181 +++++++++-
.../selftests/bpf/progs/local_storage.c | 87 +++--
18 files changed, 705 insertions(+), 51 deletions(-)
create mode 100644 kernel/bpf/bpf_task_storage.c
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 1/8] bpf: Implement task local storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 23:47 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 2/8] libbpf: Add support for " KP Singh
` (6 subsequent siblings)
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
Similar to bpf_local_storage for sockets and inodes add local storage
for task_struct.
The life-cycle of storage is managed with the life-cycle of the
task_struct. i.e. the storage is destroyed along with the owning task
with a callback to the bpf_task_storage_free from the task_free LSM
hook.
The BPF LSM allocates an __rcu pointer to the bpf_local_storage in
the security blob which are now stackable and can co-exist with other
LSMs.
The userspace map operations can be done by using a pid fd as a key
passed to the lookup, update and delete operations.
Signed-off-by: KP Singh <kpsingh@google.com>
---
include/linux/bpf_lsm.h | 23 +++
include/linux/bpf_types.h | 1 +
include/uapi/linux/bpf.h | 39 ++++
kernel/bpf/Makefile | 1 +
kernel/bpf/bpf_lsm.c | 4 +
kernel/bpf/bpf_task_storage.c | 313 +++++++++++++++++++++++++++++++++
kernel/bpf/syscall.c | 3 +-
kernel/bpf/verifier.c | 10 ++
security/bpf/hooks.c | 2 +
tools/include/uapi/linux/bpf.h | 39 ++++
10 files changed, 434 insertions(+), 1 deletion(-)
create mode 100644 kernel/bpf/bpf_task_storage.c
diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h
index aaacb6aafc87..326cb68a3632 100644
--- a/include/linux/bpf_lsm.h
+++ b/include/linux/bpf_lsm.h
@@ -7,6 +7,7 @@
#ifndef _LINUX_BPF_LSM_H
#define _LINUX_BPF_LSM_H
+#include "linux/sched.h"
#include <linux/bpf.h>
#include <linux/lsm_hooks.h>
@@ -35,9 +36,21 @@ static inline struct bpf_storage_blob *bpf_inode(
return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
}
+static inline struct bpf_storage_blob *bpf_task(
+ const struct task_struct *task)
+{
+ if (unlikely(!task->security))
+ return NULL;
+
+ return task->security + bpf_lsm_blob_sizes.lbs_task;
+}
+
extern const struct bpf_func_proto bpf_inode_storage_get_proto;
extern const struct bpf_func_proto bpf_inode_storage_delete_proto;
+extern const struct bpf_func_proto bpf_task_storage_get_proto;
+extern const struct bpf_func_proto bpf_task_storage_delete_proto;
void bpf_inode_storage_free(struct inode *inode);
+void bpf_task_storage_free(struct task_struct *task);
#else /* !CONFIG_BPF_LSM */
@@ -53,10 +66,20 @@ static inline struct bpf_storage_blob *bpf_inode(
return NULL;
}
+static inline struct bpf_storage_blob *bpf_task(
+ const struct task_struct *task)
+{
+ return NULL;
+}
+
static inline void bpf_inode_storage_free(struct inode *inode)
{
}
+static inline void bpf_task_storage_free(struct task_struct *task)
+{
+}
+
#endif /* CONFIG_BPF_LSM */
#endif /* _LINUX_BPF_LSM_H */
diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h
index 2e6f568377f1..99f7fd657d87 100644
--- a/include/linux/bpf_types.h
+++ b/include/linux/bpf_types.h
@@ -109,6 +109,7 @@ BPF_MAP_TYPE(BPF_MAP_TYPE_SOCKHASH, sock_hash_ops)
#endif
#ifdef CONFIG_BPF_LSM
BPF_MAP_TYPE(BPF_MAP_TYPE_INODE_STORAGE, inode_storage_map_ops)
+BPF_MAP_TYPE(BPF_MAP_TYPE_TASK_STORAGE, task_storage_map_ops)
#endif
BPF_MAP_TYPE(BPF_MAP_TYPE_CPUMAP, cpu_map_ops)
#if defined(CONFIG_XDP_SOCKETS)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e6ceac3f7d62..f4037b2161a6 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -157,6 +157,7 @@ enum bpf_map_type {
BPF_MAP_TYPE_STRUCT_OPS,
BPF_MAP_TYPE_RINGBUF,
BPF_MAP_TYPE_INODE_STORAGE,
+ BPF_MAP_TYPE_TASK_STORAGE,
};
/* Note that tracing related programs such as
@@ -3742,6 +3743,42 @@ union bpf_attr {
* Return
* The helper returns **TC_ACT_REDIRECT** on success or
* **TC_ACT_SHOT** on error.
+ *
+ * void *bpf_task_storage_get(struct bpf_map *map, struct task_struct *task, void *value, u64 flags)
+ * Description
+ * Get a bpf_local_storage from the *task*.
+ *
+ * Logically, it could be thought of as getting the value from
+ * a *map* with *task* as the **key**. From this
+ * perspective, the usage is not much different from
+ * **bpf_map_lookup_elem**\ (*map*, **&**\ *task*) except this
+ * helper enforces the key must be an task_struct and the map must also
+ * be a **BPF_MAP_TYPE_TASK_STORAGE**.
+ *
+ * Underneath, the value is stored locally at *task* instead of
+ * the *map*. The *map* is used as the bpf-local-storage
+ * "type". The bpf-local-storage "type" (i.e. the *map*) is
+ * searched against all bpf_local_storage residing at *task*.
+ *
+ * An optional *flags* (**BPF_LOCAL_STORAGE_GET_F_CREATE**) can be
+ * used such that a new bpf_local_storage will be
+ * created if one does not exist. *value* can be used
+ * together with **BPF_LOCAL_STORAGE_GET_F_CREATE** to specify
+ * the initial value of a bpf_local_storage. If *value* is
+ * **NULL**, the new bpf_local_storage will be zero initialized.
+ * Return
+ * A bpf_local_storage pointer is returned on success.
+ *
+ * **NULL** if not found or there was an error in adding
+ * a new bpf_local_storage.
+ *
+ * long bpf_task_storage_delete(struct bpf_map *map, struct task_struct *task)
+ * Description
+ * Delete a bpf_local_storage from a *task*.
+ * Return
+ * 0 on success.
+ *
+ * **-ENOENT** if the bpf_local_storage cannot be found.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -3900,6 +3937,8 @@ union bpf_attr {
FN(bpf_per_cpu_ptr), \
FN(bpf_this_cpu_ptr), \
FN(redirect_peer), \
+ FN(task_storage_get), \
+ FN(task_storage_delete), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile
index bdc8cd1b6767..f0b93ced5a7f 100644
--- a/kernel/bpf/Makefile
+++ b/kernel/bpf/Makefile
@@ -6,6 +6,7 @@ obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o bpf_i
obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o
obj-$(CONFIG_BPF_SYSCALL) += local_storage.o queue_stack_maps.o ringbuf.o
obj-${CONFIG_BPF_LSM} += bpf_inode_storage.o
+obj-${CONFIG_BPF_LSM} += bpf_task_storage.o
obj-$(CONFIG_BPF_SYSCALL) += disasm.o
obj-$(CONFIG_BPF_JIT) += trampoline.o
obj-$(CONFIG_BPF_SYSCALL) += btf.o
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 78ea8a7bd27f..61f8cc52fd5b 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -59,6 +59,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
return &bpf_sk_storage_get_proto;
case BPF_FUNC_sk_storage_delete:
return &bpf_sk_storage_delete_proto;
+ case BPF_FUNC_task_storage_get:
+ return &bpf_task_storage_get_proto;
+ case BPF_FUNC_task_storage_delete:
+ return &bpf_task_storage_delete_proto;
default:
return tracing_prog_func_proto(func_id, prog);
}
diff --git a/kernel/bpf/bpf_task_storage.c b/kernel/bpf/bpf_task_storage.c
new file mode 100644
index 000000000000..f5ed5eedc532
--- /dev/null
+++ b/kernel/bpf/bpf_task_storage.c
@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 Facebook
+ * Copyright 2020 Google LLC.
+ */
+
+#include "linux/pid.h"
+#include "linux/sched.h"
+#include <linux/rculist.h>
+#include <linux/list.h>
+#include <linux/hash.h>
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/bpf.h>
+#include <linux/bpf_local_storage.h>
+#include <linux/filter.h>
+#include <uapi/linux/btf.h>
+#include <linux/bpf_lsm.h>
+#include <linux/btf_ids.h>
+#include <linux/fdtable.h>
+
+DEFINE_BPF_STORAGE_CACHE(task_cache);
+
+static struct bpf_local_storage __rcu **task_storage_ptr(void *owner)
+{
+ struct task_struct *task = owner;
+ struct bpf_storage_blob *bsb;
+
+ bsb = bpf_task(task);
+ if (!bsb)
+ return NULL;
+ return &bsb->storage;
+}
+
+static struct bpf_local_storage_data *
+task_storage_lookup(struct task_struct *task, struct bpf_map *map,
+ bool cacheit_lockit)
+{
+ struct bpf_local_storage *task_storage;
+ struct bpf_local_storage_map *smap;
+ struct bpf_storage_blob *bsb;
+
+ bsb = bpf_task(task);
+ if (!bsb)
+ return NULL;
+
+ task_storage = rcu_dereference(bsb->storage);
+ if (!task_storage)
+ return NULL;
+
+ smap = (struct bpf_local_storage_map *)map;
+ return bpf_local_storage_lookup(task_storage, smap, cacheit_lockit);
+}
+
+void bpf_task_storage_free(struct task_struct *task)
+{
+ struct bpf_local_storage_elem *selem;
+ struct bpf_local_storage *local_storage;
+ bool free_task_storage = false;
+ struct bpf_storage_blob *bsb;
+ struct hlist_node *n;
+
+ bsb = bpf_task(task);
+ if (!bsb)
+ return;
+
+ rcu_read_lock();
+
+ local_storage = rcu_dereference(bsb->storage);
+ if (!local_storage) {
+ rcu_read_unlock();
+ return;
+ }
+
+ /* Neither the bpf_prog nor the bpf-map's syscall
+ * could be modifying the local_storage->list now.
+ * Thus, no elem can be added-to or deleted-from the
+ * local_storage->list by the bpf_prog or by the bpf-map's syscall.
+ *
+ * It is racing with bpf_local_storage_map_free() alone
+ * when unlinking elem from the local_storage->list and
+ * the map's bucket->list.
+ */
+ raw_spin_lock_bh(&local_storage->lock);
+ hlist_for_each_entry_safe(selem, n, &local_storage->list, snode) {
+ /* Always unlink from map before unlinking from
+ * local_storage.
+ */
+ bpf_selem_unlink_map(selem);
+ free_task_storage = bpf_selem_unlink_storage_nolock(
+ local_storage, selem, false);
+ }
+ raw_spin_unlock_bh(&local_storage->lock);
+ rcu_read_unlock();
+
+ /* free_task_storage should always be true as long as
+ * local_storage->list was non-empty.
+ */
+ if (free_task_storage)
+ kfree_rcu(local_storage, rcu);
+}
+
+static void *bpf_pid_task_storage_lookup_elem(struct bpf_map *map, void *key)
+{
+ struct bpf_local_storage_data *sdata;
+ struct task_struct *task;
+ unsigned int f_flags;
+ struct pid *pid;
+ int fd, err;
+
+ fd = *(int *)key;
+ pid = pidfd_get_pid(fd, &f_flags);
+ if (IS_ERR(pid))
+ return ERR_CAST(pid);
+
+ /* We should be in an RCU read side critical section, it should be safe
+ * to call pid_task.
+ */
+ WARN_ON_ONCE(!rcu_read_lock_held());
+ task = pid_task(pid, PIDTYPE_PID);
+ if (!task) {
+ err = -ENOENT;
+ goto out;
+ }
+
+ sdata = task_storage_lookup(task, map, true);
+ put_pid(pid);
+ return sdata ? sdata->data : NULL;
+out:
+ put_pid(pid);
+ return ERR_PTR(err);
+}
+
+static int bpf_pid_task_storage_update_elem(struct bpf_map *map, void *key,
+ void *value, u64 map_flags)
+{
+ struct bpf_local_storage_data *sdata;
+ struct task_struct *task;
+ unsigned int f_flags;
+ struct pid *pid;
+ int fd, err;
+
+ fd = *(int *)key;
+ pid = pidfd_get_pid(fd, &f_flags);
+ if (IS_ERR(pid))
+ return PTR_ERR(pid);
+
+ /* We should be in an RCU read side critical section, it should be safe
+ * to call pid_task.
+ */
+ WARN_ON_ONCE(!rcu_read_lock_held());
+ task = pid_task(pid, PIDTYPE_PID);
+ if (!task) {
+ err = -ENOENT;
+ goto out;
+ }
+
+ sdata = bpf_local_storage_update(
+ task, (struct bpf_local_storage_map *)map, value, map_flags);
+
+ err = PTR_ERR_OR_ZERO(sdata);
+out:
+ put_pid(pid);
+ return err;
+}
+
+static int task_storage_delete(struct task_struct *task, struct bpf_map *map)
+{
+ struct bpf_local_storage_data *sdata;
+
+ sdata = task_storage_lookup(task, map, false);
+ if (!sdata)
+ return -ENOENT;
+
+ bpf_selem_unlink(SELEM(sdata));
+
+ return 0;
+}
+
+static int bpf_pid_task_storage_delete_elem(struct bpf_map *map, void *key)
+{
+ struct task_struct *task;
+ unsigned int f_flags;
+ struct pid *pid;
+ int fd, err;
+
+ fd = *(int *)key;
+ pid = pidfd_get_pid(fd, &f_flags);
+ if (IS_ERR(pid))
+ return PTR_ERR(pid);
+
+ /* We should be in an RCU read side critical section, it should be safe
+ * to call pid_task.
+ */
+ WARN_ON_ONCE(!rcu_read_lock_held());
+ task = pid_task(pid, PIDTYPE_PID);
+ if (!task) {
+ err = -ENOENT;
+ goto out;
+ }
+
+ err = task_storage_delete(task, map);
+out:
+ put_pid(pid);
+ return err;
+}
+
+BPF_CALL_4(bpf_task_storage_get, struct bpf_map *, map, struct task_struct *,
+ task, void *, value, u64, flags)
+{
+ struct bpf_local_storage_data *sdata;
+
+ if (flags & ~(BPF_LOCAL_STORAGE_GET_F_CREATE))
+ return (unsigned long)NULL;
+
+ /* explicitly check that the task_storage_ptr is not
+ * NULL as task_storage_lookup returns NULL in this case and
+ * bpf_local_storage_update expects the owner to have a
+ * valid storage pointer.
+ */
+ if (!task_storage_ptr(task))
+ return (unsigned long)NULL;
+
+ sdata = task_storage_lookup(task, map, true);
+ if (sdata)
+ return (unsigned long)sdata->data;
+
+ /* This helper must only called from where the task is guaranteed
+ * to have a refcount and cannot be freed.
+ */
+ if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
+ sdata = bpf_local_storage_update(
+ task, (struct bpf_local_storage_map *)map, value,
+ BPF_NOEXIST);
+ return IS_ERR(sdata) ? (unsigned long)NULL :
+ (unsigned long)sdata->data;
+ }
+
+ return (unsigned long)NULL;
+}
+
+BPF_CALL_2(bpf_task_storage_delete, struct bpf_map *, map, struct task_struct *,
+ task)
+{
+ /* This helper must only called from where the task is guaranteed
+ * to have a refcount and cannot be freed.
+ */
+ return task_storage_delete(task, map);
+}
+
+static int notsupp_get_next_key(struct bpf_map *map, void *key, void *next_key)
+{
+ return -ENOTSUPP;
+}
+
+static struct bpf_map *task_storage_map_alloc(union bpf_attr *attr)
+{
+ struct bpf_local_storage_map *smap;
+
+ smap = bpf_local_storage_map_alloc(attr);
+ if (IS_ERR(smap))
+ return ERR_CAST(smap);
+
+ smap->cache_idx = bpf_local_storage_cache_idx_get(&task_cache);
+ return &smap->map;
+}
+
+static void task_storage_map_free(struct bpf_map *map)
+{
+ struct bpf_local_storage_map *smap;
+
+ smap = (struct bpf_local_storage_map *)map;
+ bpf_local_storage_cache_idx_free(&task_cache, smap->cache_idx);
+ bpf_local_storage_map_free(smap);
+}
+
+static int task_storage_map_btf_id;
+const struct bpf_map_ops task_storage_map_ops = {
+ .map_meta_equal = bpf_map_meta_equal,
+ .map_alloc_check = bpf_local_storage_map_alloc_check,
+ .map_alloc = task_storage_map_alloc,
+ .map_free = task_storage_map_free,
+ .map_get_next_key = notsupp_get_next_key,
+ .map_lookup_elem = bpf_pid_task_storage_lookup_elem,
+ .map_update_elem = bpf_pid_task_storage_update_elem,
+ .map_delete_elem = bpf_pid_task_storage_delete_elem,
+ .map_check_btf = bpf_local_storage_map_check_btf,
+ .map_btf_name = "bpf_local_storage_map",
+ .map_btf_id = &task_storage_map_btf_id,
+ .map_owner_storage_ptr = task_storage_ptr,
+};
+
+BTF_ID_LIST_SINGLE(bpf_task_storage_btf_ids, struct, task_struct)
+
+const struct bpf_func_proto bpf_task_storage_get_proto = {
+ .func = bpf_task_storage_get,
+ .gpl_only = false,
+ .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
+ .arg1_type = ARG_CONST_MAP_PTR,
+ .arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &bpf_task_storage_btf_ids[0],
+ .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
+ .arg4_type = ARG_ANYTHING,
+};
+
+const struct bpf_func_proto bpf_task_storage_delete_proto = {
+ .func = bpf_task_storage_delete,
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_CONST_MAP_PTR,
+ .arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &bpf_task_storage_btf_ids[0],
+};
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8f50c9c19f1b..f3fe9f53f93c 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -773,7 +773,8 @@ static int map_check_btf(struct bpf_map *map, const struct btf *btf,
map->map_type != BPF_MAP_TYPE_ARRAY &&
map->map_type != BPF_MAP_TYPE_CGROUP_STORAGE &&
map->map_type != BPF_MAP_TYPE_SK_STORAGE &&
- map->map_type != BPF_MAP_TYPE_INODE_STORAGE)
+ map->map_type != BPF_MAP_TYPE_INODE_STORAGE &&
+ map->map_type != BPF_MAP_TYPE_TASK_STORAGE)
return -ENOTSUPP;
if (map->spin_lock_off + sizeof(struct bpf_spin_lock) >
map->value_size) {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6200519582a6..b0790876694f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4469,6 +4469,11 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
func_id != BPF_FUNC_inode_storage_delete)
goto error;
break;
+ case BPF_MAP_TYPE_TASK_STORAGE:
+ if (func_id != BPF_FUNC_task_storage_get &&
+ func_id != BPF_FUNC_task_storage_delete)
+ goto error;
+ break;
default:
break;
}
@@ -4547,6 +4552,11 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
if (map->map_type != BPF_MAP_TYPE_INODE_STORAGE)
goto error;
break;
+ case BPF_FUNC_task_storage_get:
+ case BPF_FUNC_task_storage_delete:
+ if (map->map_type != BPF_MAP_TYPE_TASK_STORAGE)
+ goto error;
+ break;
default:
break;
}
diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
index 788667d582ae..e5971fa74fd7 100644
--- a/security/bpf/hooks.c
+++ b/security/bpf/hooks.c
@@ -12,6 +12,7 @@ static struct security_hook_list bpf_lsm_hooks[] __lsm_ro_after_init = {
#include <linux/lsm_hook_defs.h>
#undef LSM_HOOK
LSM_HOOK_INIT(inode_free_security, bpf_inode_storage_free),
+ LSM_HOOK_INIT(task_free, bpf_task_storage_free),
};
static int __init bpf_lsm_init(void)
@@ -23,6 +24,7 @@ static int __init bpf_lsm_init(void)
struct lsm_blob_sizes bpf_lsm_blob_sizes __lsm_ro_after_init = {
.lbs_inode = sizeof(struct bpf_storage_blob),
+ .lbs_task = sizeof(struct bpf_storage_blob),
};
DEFINE_LSM(bpf) = {
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e6ceac3f7d62..f4037b2161a6 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -157,6 +157,7 @@ enum bpf_map_type {
BPF_MAP_TYPE_STRUCT_OPS,
BPF_MAP_TYPE_RINGBUF,
BPF_MAP_TYPE_INODE_STORAGE,
+ BPF_MAP_TYPE_TASK_STORAGE,
};
/* Note that tracing related programs such as
@@ -3742,6 +3743,42 @@ union bpf_attr {
* Return
* The helper returns **TC_ACT_REDIRECT** on success or
* **TC_ACT_SHOT** on error.
+ *
+ * void *bpf_task_storage_get(struct bpf_map *map, struct task_struct *task, void *value, u64 flags)
+ * Description
+ * Get a bpf_local_storage from the *task*.
+ *
+ * Logically, it could be thought of as getting the value from
+ * a *map* with *task* as the **key**. From this
+ * perspective, the usage is not much different from
+ * **bpf_map_lookup_elem**\ (*map*, **&**\ *task*) except this
+ * helper enforces the key must be an task_struct and the map must also
+ * be a **BPF_MAP_TYPE_TASK_STORAGE**.
+ *
+ * Underneath, the value is stored locally at *task* instead of
+ * the *map*. The *map* is used as the bpf-local-storage
+ * "type". The bpf-local-storage "type" (i.e. the *map*) is
+ * searched against all bpf_local_storage residing at *task*.
+ *
+ * An optional *flags* (**BPF_LOCAL_STORAGE_GET_F_CREATE**) can be
+ * used such that a new bpf_local_storage will be
+ * created if one does not exist. *value* can be used
+ * together with **BPF_LOCAL_STORAGE_GET_F_CREATE** to specify
+ * the initial value of a bpf_local_storage. If *value* is
+ * **NULL**, the new bpf_local_storage will be zero initialized.
+ * Return
+ * A bpf_local_storage pointer is returned on success.
+ *
+ * **NULL** if not found or there was an error in adding
+ * a new bpf_local_storage.
+ *
+ * long bpf_task_storage_delete(struct bpf_map *map, struct task_struct *task)
+ * Description
+ * Delete a bpf_local_storage from a *task*.
+ * Return
+ * 0 on success.
+ *
+ * **-ENOENT** if the bpf_local_storage cannot be found.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -3900,6 +3937,8 @@ union bpf_attr {
FN(bpf_per_cpu_ptr), \
FN(bpf_this_cpu_ptr), \
FN(redirect_peer), \
+ FN(task_storage_get), \
+ FN(task_storage_delete), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 2/8] libbpf: Add support for task local storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 1/8] bpf: Implement task local storage KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 19:28 ` Andrii Nakryiko
2020-11-03 15:31 ` [PATCH bpf-next v2 3/8] bpftool: " KP Singh
` (5 subsequent siblings)
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
Signed-off-by: KP Singh <kpsingh@google.com>
---
tools/lib/bpf/libbpf_probes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
index 5482a9b7ae2d..bed00ca194f0 100644
--- a/tools/lib/bpf/libbpf_probes.c
+++ b/tools/lib/bpf/libbpf_probes.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
/* Copyright (c) 2019 Netronome Systems, Inc. */
+#include "linux/bpf.h"
#include <errno.h>
#include <fcntl.h>
#include <string.h>
@@ -230,6 +231,7 @@ bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex)
break;
case BPF_MAP_TYPE_SK_STORAGE:
case BPF_MAP_TYPE_INODE_STORAGE:
+ case BPF_MAP_TYPE_TASK_STORAGE:
btf_key_type_id = 1;
btf_value_type_id = 3;
value_size = 8;
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 3/8] bpftool: Add support for task local storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 1/8] bpf: Implement task local storage KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 2/8] libbpf: Add support for " KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 23:50 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID KP Singh
` (4 subsequent siblings)
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
Signed-off-by: KP Singh <kpsingh@google.com>
---
tools/bpf/bpftool/Documentation/bpftool-map.rst | 3 ++-
tools/bpf/bpftool/bash-completion/bpftool | 2 +-
tools/bpf/bpftool/map.c | 4 +++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
index dade10cdf295..3d52256ba75f 100644
--- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
+++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
@@ -50,7 +50,8 @@ MAP COMMANDS
| | **lru_percpu_hash** | **lpm_trie** | **array_of_maps** | **hash_of_maps**
| | **devmap** | **devmap_hash** | **sockmap** | **cpumap** | **xskmap** | **sockhash**
| | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage**
-| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage** }
+| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage**
+ | **task_storage** }
DESCRIPTION
===========
diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
index 3f1da30c4da6..fdffbc64c65c 100644
--- a/tools/bpf/bpftool/bash-completion/bpftool
+++ b/tools/bpf/bpftool/bash-completion/bpftool
@@ -705,7 +705,7 @@ _bpftool()
hash_of_maps devmap devmap_hash sockmap cpumap \
xskmap sockhash cgroup_storage reuseport_sockarray \
percpu_cgroup_storage queue stack sk_storage \
- struct_ops inode_storage' -- \
+ struct_ops inode_storage task_storage' -- \
"$cur" ) )
return 0
;;
diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index a7efbd84fbcc..b400364ee054 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -51,6 +51,7 @@ const char * const map_type_name[] = {
[BPF_MAP_TYPE_STRUCT_OPS] = "struct_ops",
[BPF_MAP_TYPE_RINGBUF] = "ringbuf",
[BPF_MAP_TYPE_INODE_STORAGE] = "inode_storage",
+ [BPF_MAP_TYPE_TASK_STORAGE] = "task_storage",
};
const size_t map_type_name_size = ARRAY_SIZE(map_type_name);
@@ -1464,7 +1465,8 @@ static int do_help(int argc, char **argv)
" lru_percpu_hash | lpm_trie | array_of_maps | hash_of_maps |\n"
" devmap | devmap_hash | sockmap | cpumap | xskmap | sockhash |\n"
" cgroup_storage | reuseport_sockarray | percpu_cgroup_storage |\n"
- " queue | stack | sk_storage | struct_ops | ringbuf | inode_storage }\n"
+ " queue | stack | sk_storage | struct_ops | ringbuf | inode_storage |\n"
+ " task_storage }\n"
" " HELP_SPEC_OPTIONS "\n"
"",
bin_name, argv[-2]);
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
` (2 preceding siblings ...)
2020-11-03 15:31 ` [PATCH bpf-next v2 3/8] bpftool: " KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 23:57 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage KP Singh
` (3 subsequent siblings)
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
The currently available bpf_get_current_task returns an unsigned integer
which can be used along with BPF_CORE_READ to read data from
the task_struct but still cannot be used as an input argument to a
helper that accepts an ARG_PTR_TO_BTF_ID of type task_struct.
In order to implement this helper a new return type, RET_PTR_TO_BTF_ID,
is added. This is similar to RET_PTR_TO_BTF_ID_OR_NULL but does not
require checking the nullness of returned pointer.
Signed-off-by: KP Singh <kpsingh@google.com>
---
include/linux/bpf.h | 1 +
include/uapi/linux/bpf.h | 9 +++++++++
kernel/bpf/verifier.c | 7 +++++--
kernel/trace/bpf_trace.c | 16 ++++++++++++++++
tools/include/uapi/linux/bpf.h | 9 +++++++++
5 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 2fffd30e13ac..73d5381a5d5c 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -310,6 +310,7 @@ enum bpf_return_type {
RET_PTR_TO_BTF_ID_OR_NULL, /* returns a pointer to a btf_id or NULL */
RET_PTR_TO_MEM_OR_BTF_ID_OR_NULL, /* returns a pointer to a valid memory or a btf_id or NULL */
RET_PTR_TO_MEM_OR_BTF_ID, /* returns a pointer to a valid memory or a btf_id */
+ RET_PTR_TO_BTF_ID, /* returns a pointer to a btf_id */
};
/* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index f4037b2161a6..9879d6793e90 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3779,6 +3779,14 @@ union bpf_attr {
* 0 on success.
*
* **-ENOENT** if the bpf_local_storage cannot be found.
+ *
+ * struct task_struct *bpf_get_current_task_btf(void)
+ * Description
+ * Return a BTF pointer to the "current" task.
+ * This pointer can also be used in helpers that accept an
+ * *ARG_PTR_TO_BTF_ID* of type *task_struct*.
+ * Return
+ * Pointer to the current task.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -3939,6 +3947,7 @@ union bpf_attr {
FN(redirect_peer), \
FN(task_storage_get), \
FN(task_storage_delete), \
+ FN(get_current_task_btf), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b0790876694f..314018e8fc12 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5186,11 +5186,14 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
PTR_TO_BTF_ID : PTR_TO_BTF_ID_OR_NULL;
regs[BPF_REG_0].btf_id = meta.ret_btf_id;
}
- } else if (fn->ret_type == RET_PTR_TO_BTF_ID_OR_NULL) {
+ } else if (fn->ret_type == RET_PTR_TO_BTF_ID_OR_NULL ||
+ fn->ret_type == RET_PTR_TO_BTF_ID) {
int ret_btf_id;
mark_reg_known_zero(env, regs, BPF_REG_0);
- regs[BPF_REG_0].type = PTR_TO_BTF_ID_OR_NULL;
+ regs[BPF_REG_0].type = fn->ret_type == RET_PTR_TO_BTF_ID ?
+ PTR_TO_BTF_ID :
+ PTR_TO_BTF_ID_OR_NULL;
ret_btf_id = *fn->ret_btf_id;
if (ret_btf_id == 0) {
verbose(env, "invalid return type %d of func %s#%d\n",
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 4517c8b66518..e4515b0f62a8 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1022,6 +1022,20 @@ const struct bpf_func_proto bpf_get_current_task_proto = {
.ret_type = RET_INTEGER,
};
+BPF_CALL_0(bpf_get_current_task_btf)
+{
+ return (unsigned long) current;
+}
+
+BTF_ID_LIST_SINGLE(bpf_get_current_btf_ids, struct, task_struct)
+
+static const struct bpf_func_proto bpf_get_current_task_btf_proto = {
+ .func = bpf_get_current_task_btf,
+ .gpl_only = true,
+ .ret_type = RET_PTR_TO_BTF_ID,
+ .ret_btf_id = &bpf_get_current_btf_ids[0],
+};
+
BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
{
struct bpf_array *array = container_of(map, struct bpf_array, map);
@@ -1265,6 +1279,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
return &bpf_get_current_pid_tgid_proto;
case BPF_FUNC_get_current_task:
return &bpf_get_current_task_proto;
+ case BPF_FUNC_get_current_task_btf:
+ return &bpf_get_current_task_btf_proto;
case BPF_FUNC_get_current_uid_gid:
return &bpf_get_current_uid_gid_proto;
case BPF_FUNC_get_current_comm:
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index f4037b2161a6..9879d6793e90 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3779,6 +3779,14 @@ union bpf_attr {
* 0 on success.
*
* **-ENOENT** if the bpf_local_storage cannot be found.
+ *
+ * struct task_struct *bpf_get_current_task_btf(void)
+ * Description
+ * Return a BTF pointer to the "current" task.
+ * This pointer can also be used in helpers that accept an
+ * *ARG_PTR_TO_BTF_ID* of type *task_struct*.
+ * Return
+ * Pointer to the current task.
*/
#define __BPF_FUNC_MAPPER(FN) \
FN(unspec), \
@@ -3939,6 +3947,7 @@ union bpf_attr {
FN(redirect_peer), \
FN(task_storage_get), \
FN(task_storage_delete), \
+ FN(get_current_task_btf), \
/* */
/* integer value in 'imm' field of BPF_CALL instruction selects which helper
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
` (3 preceding siblings ...)
2020-11-03 15:31 ` [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-04 0:16 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h KP Singh
` (2 subsequent siblings)
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
The {inode,sk}_storage_result checking if the correct value was retrieved
was being clobbered unconditionally by the return value of the
bpf_{inode,sk}_storage_delete call.
Also, consistently use the newly added BPF_LOCAL_STORAGE_GET_F_CREATE
flag.
Fixes: cd324d7abb3d ("bpf: Add selftests for local_storage")
Signed-off-by: KP Singh <kpsingh@google.com>
---
.../selftests/bpf/progs/local_storage.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
index 0758ba229ae0..09529e33be98 100644
--- a/tools/testing/selftests/bpf/progs/local_storage.c
+++ b/tools/testing/selftests/bpf/progs/local_storage.c
@@ -58,20 +58,22 @@ int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
struct dummy_storage *storage;
+ int err;
if (pid != monitored_pid)
return 0;
storage = bpf_inode_storage_get(&inode_storage_map, victim->d_inode, 0,
- BPF_SK_STORAGE_GET_F_CREATE);
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
if (!storage)
return 0;
- if (storage->value == DUMMY_STORAGE_VALUE)
+ if (storage->value != DUMMY_STORAGE_VALUE)
inode_storage_result = -1;
- inode_storage_result =
- bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
+ err = bpf_inode_storage_delete(&inode_storage_map, victim->d_inode);
+ if (!err)
+ inode_storage_result = err;
return 0;
}
@@ -82,19 +84,23 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address,
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
struct dummy_storage *storage;
+ int err;
if (pid != monitored_pid)
return 0;
storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
- BPF_SK_STORAGE_GET_F_CREATE);
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
if (!storage)
return 0;
- if (storage->value == DUMMY_STORAGE_VALUE)
+ if (storage->value != DUMMY_STORAGE_VALUE)
sk_storage_result = -1;
- sk_storage_result = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
+ err = bpf_sk_storage_delete(&sk_storage_map, sock->sk);
+ if (!err)
+ sk_storage_result = err;
+
return 0;
}
@@ -109,7 +115,7 @@ int BPF_PROG(socket_post_create, struct socket *sock, int family, int type,
return 0;
storage = bpf_sk_storage_get(&sk_storage_map, sock->sk, 0,
- BPF_SK_STORAGE_GET_F_CREATE);
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
if (!storage)
return 0;
@@ -131,7 +137,7 @@ int BPF_PROG(file_open, struct file *file)
return 0;
storage = bpf_inode_storage_get(&inode_storage_map, file->f_inode, 0,
- BPF_LOCAL_STORAGE_GET_F_CREATE);
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
if (!storage)
return 0;
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
` (4 preceding siblings ...)
2020-11-03 15:31 ` [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-04 0:16 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage KP Singh
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
With the fixing of BTF pruning of embedded types being fixed, the test
can be simplified to use vmlinux.h
Signed-off-by: KP Singh <kpsingh@google.com>
---
.../selftests/bpf/progs/local_storage.c | 20 +------------------
1 file changed, 1 insertion(+), 19 deletions(-)
diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
index 09529e33be98..ef3822bc7542 100644
--- a/tools/testing/selftests/bpf/progs/local_storage.c
+++ b/tools/testing/selftests/bpf/progs/local_storage.c
@@ -4,9 +4,8 @@
* Copyright 2020 Google LLC.
*/
+#include "vmlinux.h"
#include <errno.h>
-#include <linux/bpf.h>
-#include <stdbool.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
@@ -36,23 +35,6 @@ struct {
__type(value, struct dummy_storage);
} sk_storage_map SEC(".maps");
-/* TODO Use vmlinux.h once BTF pruning for embedded types is fixed.
- */
-struct sock {} __attribute__((preserve_access_index));
-struct sockaddr {} __attribute__((preserve_access_index));
-struct socket {
- struct sock *sk;
-} __attribute__((preserve_access_index));
-
-struct inode {} __attribute__((preserve_access_index));
-struct dentry {
- struct inode *d_inode;
-} __attribute__((preserve_access_index));
-struct file {
- struct inode *f_inode;
-} __attribute__((preserve_access_index));
-
-
SEC("lsm/inode_unlink")
int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
{
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
` (5 preceding siblings ...)
2020-11-03 15:31 ` [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 18:47 ` Alexei Starovoitov
2020-11-03 15:31 ` [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage KP Singh
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
The test exercises the syscall based map operations by creating a pidfd
for the current process.
For verifying kernel / LSM functionality, the test implements a simple
MAC policy which denies an executable from unlinking itself. The LSM
program bprm_committed_creds sets a task_local_storage with a pointer to
the inode. This is then used to detect if the task is trying to unlink
itself in the inode_unlink LSM hook.
The test copies /bin/rm to /tmp and executes it in a child thread with
the intention of deleting itself. A successful test should prevent the
the running executable from deleting itself.
The temporary file is cleaned up later in the test.
Signed-off-by: KP Singh <kpsingh@google.com>
---
.../bpf/prog_tests/test_local_storage.c | 167 ++++++++++++++++--
.../selftests/bpf/progs/local_storage.c | 45 ++++-
2 files changed, 194 insertions(+), 18 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
index 91cd6f357246..feba23f8848b 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
@@ -4,30 +4,149 @@
* Copyright (C) 2020 Google LLC.
*/
+#define _GNU_SOURCE
+
+#include <asm-generic/errno-base.h>
+#include <unistd.h>
+#include <sys/stat.h>
#include <test_progs.h>
#include <linux/limits.h>
#include "local_storage.skel.h"
#include "network_helpers.h"
-int create_and_unlink_file(void)
+static inline int sys_pidfd_open(pid_t pid, unsigned int flags)
+{
+ return syscall(__NR_pidfd_open, pid, flags);
+}
+
+unsigned int duration;
+
+#define TEST_STORAGE_VALUE 0xbeefdead
+
+struct storage {
+ void *inode;
+ unsigned int value;
+ /* Lock ensures that spin locked versions of local stoage operations
+ * also work, most operations in this tests are still single threaded
+ */
+ struct bpf_spin_lock lock;
+};
+
+/* Copies an rm binary to a temp file. dest is a mkstemp template */
+int copy_rm(char *dest)
{
- char fname[PATH_MAX] = "/tmp/fileXXXXXX";
- int fd;
+ int ret, fd_in, fd_out;
+ struct stat stat;
- fd = mkstemp(fname);
- if (fd < 0)
- return fd;
+ fd_in = open("/bin/rm", O_RDONLY);
+ if (fd_in < 0)
+ return fd_in;
- close(fd);
- unlink(fname);
+ fd_out = mkstemp(dest);
+ if (fd_out < 0)
+ return fd_out;
+
+ ret = fstat(fd_in, &stat);
+ if (ret == -1)
+ return errno;
+
+ ret = copy_file_range(fd_in, NULL, fd_out, NULL, stat.st_size, 0);
+ if (ret == -1)
+ return errno;
+
+ /* Set executable permission on the copied file */
+ ret = chmod(dest, 0100);
+ if (ret == -1)
+ return errno;
+
+ close(fd_in);
+ close(fd_out);
return 0;
}
+/* Fork and exec the provided rm binary and return the exit code of the
+ * forked process and its pid.
+ */
+int run_self_unlink(int *monitored_pid, const char *rm_path)
+{
+ int child_pid, child_status, ret;
+ int null_fd;
+
+ child_pid = fork();
+ if (child_pid == 0) {
+ null_fd = open("/dev/null", O_WRONLY);
+ dup2(null_fd, STDOUT_FILENO);
+ dup2(null_fd, STDERR_FILENO);
+ close(null_fd);
+
+ *monitored_pid = getpid();
+ /* Use the copied /usr/bin/rm to delete itself
+ * /tmp/copy_of_rm /tmp/copy_of_rm.
+ */
+ ret = execlp(rm_path, rm_path, rm_path, NULL);
+ if (ret)
+ exit(errno);
+ } else if (child_pid > 0) {
+ waitpid(child_pid, &child_status, 0);
+ return WEXITSTATUS(child_status);
+ }
+
+ return -EINVAL;
+}
+
+bool check_syscall_operations(int map_fd, int obj_fd)
+{
+ struct storage val = { .value = TEST_STORAGE_VALUE, .lock = { 0 } },
+ lookup_val = { .value = 0, .lock = { 0 } };
+ int err;
+
+ /* Looking up an existing element should fail initially */
+ err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
+ BPF_F_LOCK);
+ if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
+ "err:%d errno:%d\n", err, errno))
+ return false;
+
+ /* Create a new element */
+ err = bpf_map_update_elem(map_fd, &obj_fd, &val,
+ BPF_NOEXIST | BPF_F_LOCK);
+ if (CHECK(err < 0, "bpf_map_update_elem", "err:%d errno:%d\n", err,
+ errno))
+ return false;
+
+ /* Lookup the newly created element */
+ err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
+ BPF_F_LOCK);
+ if (CHECK(err < 0, "bpf_map_lookup_elem", "err:%d errno:%d", err,
+ errno))
+ return false;
+
+ /* Check the value of the newly created element */
+ if (CHECK(lookup_val.value != val.value, "bpf_map_lookup_elem",
+ "value got = %x errno:%d", lookup_val.value, val.value))
+ return false;
+
+ err = bpf_map_delete_elem(map_fd, &obj_fd);
+ if (CHECK(err, "bpf_map_delete_elem()", "err:%d errno:%d\n", err,
+ errno))
+ return false;
+
+ /* The lookup should fail, now that the element has been deleted */
+ err = bpf_map_lookup_elem_flags(map_fd, &obj_fd, &lookup_val,
+ BPF_F_LOCK);
+ if (CHECK(!err || errno != ENOENT, "bpf_map_lookup_elem",
+ "err:%d errno:%d\n", err, errno))
+ return false;
+
+ return true;
+}
+
void test_test_local_storage(void)
{
+ char tmp_exec_path[PATH_MAX] = "/tmp/copy_of_rmXXXXXX";
+ int err, serv_sk = -1, task_fd = -1;
struct local_storage *skel = NULL;
- int err, duration = 0, serv_sk = -1;
skel = local_storage__open_and_load();
if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
@@ -37,10 +156,35 @@ void test_test_local_storage(void)
if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
goto close_prog;
+ task_fd = sys_pidfd_open(getpid(), 0);
+ if (CHECK(task_fd < 0, "pidfd_open",
+ "failed to get pidfd err:%d, errno:%d", task_fd, errno))
+ goto close_prog;
+
+ if (!check_syscall_operations(bpf_map__fd(skel->maps.task_storage_map),
+ task_fd))
+ goto close_prog;
+
+ err = copy_rm(tmp_exec_path);
+ if (CHECK(err < 0, "copy_rm", "err %d errno %d\n", err, errno))
+ goto close_prog;
+
+ /* Sets skel->bss->monitored_pid to the pid of the forked child
+ * forks a child process that executes tmp_exec_path and tries to
+ * unlink its executable. This operation should be denied by the loaded
+ * LSM program.
+ */
+ err = run_self_unlink(&skel->bss->monitored_pid, tmp_exec_path);
+ if (CHECK(err != EPERM, "run_self_unlink", "err %d want EPERM\n", err))
+ goto close_prog;
+
+ /* Set the process being monitored to be the current process */
skel->bss->monitored_pid = getpid();
- err = create_and_unlink_file();
- if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
+ /* Remove the temporary created executable */
+ err = unlink(tmp_exec_path);
+ if (CHECK(err != 0, "unlink", "unable to unlink %s: %d", tmp_exec_path,
+ errno))
goto close_prog;
CHECK(skel->data->inode_storage_result != 0, "inode_storage_result",
@@ -56,5 +200,6 @@ void test_test_local_storage(void)
close(serv_sk);
close_prog:
+ close(task_fd);
local_storage__destroy(skel);
}
diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
index ef3822bc7542..a4979982ce80 100644
--- a/tools/testing/selftests/bpf/progs/local_storage.c
+++ b/tools/testing/selftests/bpf/progs/local_storage.c
@@ -17,34 +17,50 @@ int monitored_pid = 0;
int inode_storage_result = -1;
int sk_storage_result = -1;
-struct dummy_storage {
+struct local_storage {
+ struct inode *exec_inode;
__u32 value;
+ struct bpf_spin_lock lock;
};
struct {
__uint(type, BPF_MAP_TYPE_INODE_STORAGE);
__uint(map_flags, BPF_F_NO_PREALLOC);
__type(key, int);
- __type(value, struct dummy_storage);
+ __type(value, struct local_storage);
} inode_storage_map SEC(".maps");
struct {
__uint(type, BPF_MAP_TYPE_SK_STORAGE);
__uint(map_flags, BPF_F_NO_PREALLOC | BPF_F_CLONE);
__type(key, int);
- __type(value, struct dummy_storage);
+ __type(value, struct local_storage);
} sk_storage_map SEC(".maps");
+struct {
+ __uint(type, BPF_MAP_TYPE_TASK_STORAGE);
+ __uint(map_flags, BPF_F_NO_PREALLOC);
+ __type(key, int);
+ __type(value, struct local_storage);
+} task_storage_map SEC(".maps");
+
SEC("lsm/inode_unlink")
int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
- struct dummy_storage *storage;
+ struct local_storage *storage;
int err;
if (pid != monitored_pid)
return 0;
+ storage = bpf_task_storage_get(&task_storage_map,
+ bpf_get_current_task_btf(), 0, 0);
+
+ /* Don't let an executable delete itself */
+ if (storage && storage->exec_inode == victim->d_inode)
+ return -EPERM;
+
storage = bpf_inode_storage_get(&inode_storage_map, victim->d_inode, 0,
BPF_LOCAL_STORAGE_GET_F_CREATE);
if (!storage)
@@ -65,7 +81,7 @@ int BPF_PROG(socket_bind, struct socket *sock, struct sockaddr *address,
int addrlen)
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
- struct dummy_storage *storage;
+ struct local_storage *storage;
int err;
if (pid != monitored_pid)
@@ -91,7 +107,7 @@ int BPF_PROG(socket_post_create, struct socket *sock, int family, int type,
int protocol, int kern)
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
- struct dummy_storage *storage;
+ struct local_storage *storage;
if (pid != monitored_pid)
return 0;
@@ -110,7 +126,7 @@ SEC("lsm/file_open")
int BPF_PROG(file_open, struct file *file)
{
__u32 pid = bpf_get_current_pid_tgid() >> 32;
- struct dummy_storage *storage;
+ struct local_storage *storage;
if (pid != monitored_pid)
return 0;
@@ -126,3 +142,18 @@ int BPF_PROG(file_open, struct file *file)
storage->value = DUMMY_STORAGE_VALUE;
return 0;
}
+
+/* This uses the local storage to remember the inode of the binary that a
+ * process was originally executing.
+ */
+SEC("lsm/bprm_committed_creds")
+void BPF_PROG(exec, struct linux_binprm *bprm)
+{
+ struct local_storage *storage;
+
+ storage = bpf_task_storage_get(&task_storage_map,
+ bpf_get_current_task_btf(), 0,
+ BPF_LOCAL_STORAGE_GET_F_CREATE);
+ if (storage)
+ storage->exec_inode = bprm->file->f_inode;
+}
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
` (6 preceding siblings ...)
2020-11-03 15:31 ` [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage KP Singh
@ 2020-11-03 15:31 ` KP Singh
2020-11-03 22:32 ` Song Liu
7 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 15:31 UTC (permalink / raw)
To: linux-kernel, bpf
Cc: Alexei Starovoitov, Daniel Borkmann, Martin KaFai Lau, Song Liu,
Paul Turner, Jann Horn, Hao Luo
From: KP Singh <kpsingh@google.com>
Signed-off-by: KP Singh <kpsingh@google.com>
---
.../bpf/prog_tests/test_local_storage.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
index feba23f8848b..2e64baabb50d 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
@@ -145,7 +145,7 @@ bool check_syscall_operations(int map_fd, int obj_fd)
void test_test_local_storage(void)
{
char tmp_exec_path[PATH_MAX] = "/tmp/copy_of_rmXXXXXX";
- int err, serv_sk = -1, task_fd = -1;
+ int err, serv_sk = -1, task_fd = -1, rm_fd = -1;
struct local_storage *skel = NULL;
skel = local_storage__open_and_load();
@@ -169,6 +169,15 @@ void test_test_local_storage(void)
if (CHECK(err < 0, "copy_rm", "err %d errno %d\n", err, errno))
goto close_prog;
+ rm_fd = open(tmp_exec_path, O_RDONLY);
+ if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d",
+ tmp_exec_path, rm_fd, errno))
+ goto close_prog;
+
+ if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map),
+ rm_fd))
+ goto close_prog;
+
/* Sets skel->bss->monitored_pid to the pid of the forked child
* forks a child process that executes tmp_exec_path and tries to
* unlink its executable. This operation should be denied by the loaded
@@ -197,9 +206,14 @@ void test_test_local_storage(void)
CHECK(skel->data->sk_storage_result != 0, "sk_storage_result",
"sk_local_storage not set\n");
+ if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map),
+ serv_sk))
+ goto close_prog;
+
close(serv_sk);
close_prog:
+ close(rm_fd);
close(task_fd);
local_storage__destroy(skel);
}
--
2.29.1.341.ge80a0c044ae-goog
^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-03 15:31 ` [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage KP Singh
@ 2020-11-03 18:47 ` Alexei Starovoitov
2020-11-03 18:59 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: Alexei Starovoitov @ 2020-11-03 18:47 UTC (permalink / raw)
To: KP Singh
Cc: linux-kernel, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 03, 2020 at 04:31:31PM +0100, KP Singh wrote:
> +
> +struct storage {
> + void *inode;
> + unsigned int value;
> + /* Lock ensures that spin locked versions of local stoage operations
> + * also work, most operations in this tests are still single threaded
> + */
> + struct bpf_spin_lock lock;
> +};
I think it's a good idea to test spin_lock in local_storage,
but it seems the test is not doing it fully.
It's only adding it to the storage, but the program is not accessing it.
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-03 18:47 ` Alexei Starovoitov
@ 2020-11-03 18:59 ` KP Singh
2020-11-04 0:05 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-03 18:59 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 7:47 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Tue, Nov 03, 2020 at 04:31:31PM +0100, KP Singh wrote:
> > +
> > +struct storage {
> > + void *inode;
> > + unsigned int value;
> > + /* Lock ensures that spin locked versions of local stoage operations
> > + * also work, most operations in this tests are still single threaded
> > + */
> > + struct bpf_spin_lock lock;
> > +};
>
> I think it's a good idea to test spin_lock in local_storage,
> but it seems the test is not doing it fully.
> It's only adding it to the storage, but the program is not accessing it.
I added it here just to check if the offset calculations (map->spin_lock_off)
are correctly happening for these new maps.
As mentioned in the updates, I do intend to generalize
tools/testing/selftests/bpf/map_tests/sk_storage_map.c which already has
the threading logic to exercise bpf_spin_lock in storage maps.
Hope this is an okay plan?
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 2/8] libbpf: Add support for task local storage
2020-11-03 15:31 ` [PATCH bpf-next v2 2/8] libbpf: Add support for " KP Singh
@ 2020-11-03 19:28 ` Andrii Nakryiko
2020-11-03 20:28 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: Andrii Nakryiko @ 2020-11-03 19:28 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 7:34 AM KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> Signed-off-by: KP Singh <kpsingh@google.com>
> ---
> tools/lib/bpf/libbpf_probes.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
> index 5482a9b7ae2d..bed00ca194f0 100644
> --- a/tools/lib/bpf/libbpf_probes.c
> +++ b/tools/lib/bpf/libbpf_probes.c
> @@ -1,6 +1,7 @@
> // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
> /* Copyright (c) 2019 Netronome Systems, Inc. */
>
> +#include "linux/bpf.h"
why "", not <>?
> #include <errno.h>
> #include <fcntl.h>
> #include <string.h>
> @@ -230,6 +231,7 @@ bool bpf_probe_map_type(enum bpf_map_type map_type, __u32 ifindex)
> break;
> case BPF_MAP_TYPE_SK_STORAGE:
> case BPF_MAP_TYPE_INODE_STORAGE:
> + case BPF_MAP_TYPE_TASK_STORAGE:
> btf_key_type_id = 1;
> btf_value_type_id = 3;
> value_size = 8;
> --
> 2.29.1.341.ge80a0c044ae-goog
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 2/8] libbpf: Add support for task local storage
2020-11-03 19:28 ` Andrii Nakryiko
@ 2020-11-03 20:28 ` KP Singh
0 siblings, 0 replies; 28+ messages in thread
From: KP Singh @ 2020-11-03 20:28 UTC (permalink / raw)
To: Andrii Nakryiko
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 8:28 PM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Tue, Nov 3, 2020 at 7:34 AM KP Singh <kpsingh@chromium.org> wrote:
> >
> > From: KP Singh <kpsingh@google.com>
> >
> > Signed-off-by: KP Singh <kpsingh@google.com>
> > ---
> > tools/lib/bpf/libbpf_probes.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/tools/lib/bpf/libbpf_probes.c b/tools/lib/bpf/libbpf_probes.c
> > index 5482a9b7ae2d..bed00ca194f0 100644
> > --- a/tools/lib/bpf/libbpf_probes.c
> > +++ b/tools/lib/bpf/libbpf_probes.c
> > @@ -1,6 +1,7 @@
> > // SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
> > /* Copyright (c) 2019 Netronome Systems, Inc. */
> >
> > +#include "linux/bpf.h"
>
> why "", not <>?
I need to disable this vscode feature where it tries to be oversmart
and adds includes. Fixed.
- KP
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage
2020-11-03 15:31 ` [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage KP Singh
@ 2020-11-03 22:32 ` Song Liu
2020-11-03 22:58 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: Song Liu @ 2020-11-03 22:32 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
A short commit log would be great...
>
> Signed-off-by: KP Singh <kpsingh@google.com>
> ---
> .../bpf/prog_tests/test_local_storage.c | 16 +++++++++++++++-
> 1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> index feba23f8848b..2e64baabb50d 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_local_storage.c
> @@ -145,7 +145,7 @@ bool check_syscall_operations(int map_fd, int obj_fd)
> void test_test_local_storage(void)
> {
> char tmp_exec_path[PATH_MAX] = "/tmp/copy_of_rmXXXXXX";
> - int err, serv_sk = -1, task_fd = -1;
> + int err, serv_sk = -1, task_fd = -1, rm_fd = -1;
> struct local_storage *skel = NULL;
>
> skel = local_storage__open_and_load();
> @@ -169,6 +169,15 @@ void test_test_local_storage(void)
> if (CHECK(err < 0, "copy_rm", "err %d errno %d\n", err, errno))
> goto close_prog;
>
> + rm_fd = open(tmp_exec_path, O_RDONLY);
> + if (CHECK(rm_fd < 0, "open", "failed to open %s err:%d, errno:%d",
> + tmp_exec_path, rm_fd, errno))
> + goto close_prog;
> +
> + if (!check_syscall_operations(bpf_map__fd(skel->maps.inode_storage_map),
> + rm_fd))
> + goto close_prog;
> +
> /* Sets skel->bss->monitored_pid to the pid of the forked child
> * forks a child process that executes tmp_exec_path and tries to
> * unlink its executable. This operation should be denied by the loaded
> @@ -197,9 +206,14 @@ void test_test_local_storage(void)
> CHECK(skel->data->sk_storage_result != 0, "sk_storage_result",
> "sk_local_storage not set\n");
>
> + if (!check_syscall_operations(bpf_map__fd(skel->maps.sk_storage_map),
> + serv_sk))
> + goto close_prog;
We shouldn't need this goto, otherwise we may leak serv_sk.
> +
> close(serv_sk);
>
> close_prog:
> + close(rm_fd);
> close(task_fd);
> local_storage__destroy(skel);
> }
> --
> 2.29.1.341.ge80a0c044ae-goog
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage
2020-11-03 22:32 ` Song Liu
@ 2020-11-03 22:58 ` KP Singh
0 siblings, 0 replies; 28+ messages in thread
From: KP Singh @ 2020-11-03 22:58 UTC (permalink / raw)
To: Song Liu
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 11:32 PM Song Liu <songliubraving@fb.com> wrote:
>
>
>
> > On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
> >
> > From: KP Singh <kpsingh@google.com>
>
> A short commit log would be great...
Sure :) No excuses for not having one, will add it in the next revision.
- KP
[...]
> > + serv_sk))
> > + goto close_prog;
>
> We shouldn't need this goto, otherwise we may leak serv_sk.
Good point, I will just move the close(serv_sk); along with the other
descriptor clean up.
>
> > +
> > close(serv_sk);
> >
> > close_prog:
> > + close(rm_fd);
> > close(task_fd);
> > local_storage__destroy(skel);
> > }
> > --
> > 2.29.1.341.ge80a0c044ae-goog
> >
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 1/8] bpf: Implement task local storage
2020-11-03 15:31 ` [PATCH bpf-next v2 1/8] bpf: Implement task local storage KP Singh
@ 2020-11-03 23:47 ` Song Liu
2020-11-03 23:54 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: Song Liu @ 2020-11-03 23:47 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> Similar to bpf_local_storage for sockets and inodes add local storage
> for task_struct.
>
> The life-cycle of storage is managed with the life-cycle of the
> task_struct. i.e. the storage is destroyed along with the owning task
> with a callback to the bpf_task_storage_free from the task_free LSM
> hook.
>
> The BPF LSM allocates an __rcu pointer to the bpf_local_storage in
> the security blob which are now stackable and can co-exist with other
> LSMs.
>
> The userspace map operations can be done by using a pid fd as a key
> passed to the lookup, update and delete operations.
>
> Signed-off-by: KP Singh <kpsingh@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
with a few nits:
> ---
> include/linux/bpf_lsm.h | 23 +++
> include/linux/bpf_types.h | 1 +
> include/uapi/linux/bpf.h | 39 ++++
> kernel/bpf/Makefile | 1 +
> kernel/bpf/bpf_lsm.c | 4 +
> kernel/bpf/bpf_task_storage.c | 313 +++++++++++++++++++++++++++++++++
> kernel/bpf/syscall.c | 3 +-
> kernel/bpf/verifier.c | 10 ++
> security/bpf/hooks.c | 2 +
> tools/include/uapi/linux/bpf.h | 39 ++++
> 10 files changed, 434 insertions(+), 1 deletion(-)
> create mode 100644 kernel/bpf/bpf_task_storage.c
>
> diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h
> index aaacb6aafc87..326cb68a3632 100644
> --- a/include/linux/bpf_lsm.h
> +++ b/include/linux/bpf_lsm.h
> @@ -7,6 +7,7 @@
> #ifndef _LINUX_BPF_LSM_H
> #define _LINUX_BPF_LSM_H
>
> +#include "linux/sched.h"
vscode?
> #include <linux/bpf.h>
> #include <linux/lsm_hooks.h>
>
> @@ -35,9 +36,21 @@ static inline struct bpf_storage_blob *bpf_inode(
> return inode->i_security + bpf_lsm_blob_sizes.lbs_inode;
> }
[...]
> index 000000000000..f5ed5eedc532
> --- /dev/null
> +++ b/kernel/bpf/bpf_task_storage.c
> @@ -0,0 +1,313 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Copyright (c) 2019 Facebook
nit: I guess we shouldn't say 2019 Facebook
> + * Copyright 2020 Google LLC.
> + */
> +
> +#include "linux/pid.h"
> +#include "linux/sched.h"
> +#include <linux/rculist.h>
> +#include <linux/list.h>
> +#include <linux/hash.h>
> +#include <linux/types.h>
[...]
> +}
> +
> +BPF_CALL_2(bpf_task_storage_delete, struct bpf_map *, map, struct task_struct *,
> + task)
> +{
> + /* This helper must only called from where the task is guaranteed
> + * to have a refcount and cannot be freed.
> + */
> + return task_storage_delete(task, map);
> +}
> +
> +static int notsupp_get_next_key(struct bpf_map *map, void *key, void *next_key)
> +{
> + return -ENOTSUPP;
> +}
This is the third copy of notsupp_get_next_key(). We can probably move it to bpf.h.
[...]
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 3/8] bpftool: Add support for task local storage
2020-11-03 15:31 ` [PATCH bpf-next v2 3/8] bpftool: " KP Singh
@ 2020-11-03 23:50 ` Song Liu
0 siblings, 0 replies; 28+ messages in thread
From: Song Liu @ 2020-11-03 23:50 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> Signed-off-by: KP Singh <kpsingh@google.com>
LGTM, except that commit log is missing (also for 2/8).
Acked-by: Song Liu <songliubraving@fb.com>
> ---
> tools/bpf/bpftool/Documentation/bpftool-map.rst | 3 ++-
> tools/bpf/bpftool/bash-completion/bpftool | 2 +-
> tools/bpf/bpftool/map.c | 4 +++-
> 3 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/tools/bpf/bpftool/Documentation/bpftool-map.rst b/tools/bpf/bpftool/Documentation/bpftool-map.rst
> index dade10cdf295..3d52256ba75f 100644
> --- a/tools/bpf/bpftool/Documentation/bpftool-map.rst
> +++ b/tools/bpf/bpftool/Documentation/bpftool-map.rst
> @@ -50,7 +50,8 @@ MAP COMMANDS
> | | **lru_percpu_hash** | **lpm_trie** | **array_of_maps** | **hash_of_maps**
> | | **devmap** | **devmap_hash** | **sockmap** | **cpumap** | **xskmap** | **sockhash**
> | | **cgroup_storage** | **reuseport_sockarray** | **percpu_cgroup_storage**
> -| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage** }
> +| | **queue** | **stack** | **sk_storage** | **struct_ops** | **ringbuf** | **inode_storage**
> + | **task_storage** }
>
> DESCRIPTION
> ===========
> diff --git a/tools/bpf/bpftool/bash-completion/bpftool b/tools/bpf/bpftool/bash-completion/bpftool
> index 3f1da30c4da6..fdffbc64c65c 100644
> --- a/tools/bpf/bpftool/bash-completion/bpftool
> +++ b/tools/bpf/bpftool/bash-completion/bpftool
> @@ -705,7 +705,7 @@ _bpftool()
> hash_of_maps devmap devmap_hash sockmap cpumap \
> xskmap sockhash cgroup_storage reuseport_sockarray \
> percpu_cgroup_storage queue stack sk_storage \
> - struct_ops inode_storage' -- \
> + struct_ops inode_storage task_storage' -- \
> "$cur" ) )
> return 0
> ;;
> diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
> index a7efbd84fbcc..b400364ee054 100644
> --- a/tools/bpf/bpftool/map.c
> +++ b/tools/bpf/bpftool/map.c
> @@ -51,6 +51,7 @@ const char * const map_type_name[] = {
> [BPF_MAP_TYPE_STRUCT_OPS] = "struct_ops",
> [BPF_MAP_TYPE_RINGBUF] = "ringbuf",
> [BPF_MAP_TYPE_INODE_STORAGE] = "inode_storage",
> + [BPF_MAP_TYPE_TASK_STORAGE] = "task_storage",
> };
>
> const size_t map_type_name_size = ARRAY_SIZE(map_type_name);
> @@ -1464,7 +1465,8 @@ static int do_help(int argc, char **argv)
> " lru_percpu_hash | lpm_trie | array_of_maps | hash_of_maps |\n"
> " devmap | devmap_hash | sockmap | cpumap | xskmap | sockhash |\n"
> " cgroup_storage | reuseport_sockarray | percpu_cgroup_storage |\n"
> - " queue | stack | sk_storage | struct_ops | ringbuf | inode_storage }\n"
> + " queue | stack | sk_storage | struct_ops | ringbuf | inode_storage |\n"
> + " task_storage }\n"
> " " HELP_SPEC_OPTIONS "\n"
> "",
> bin_name, argv[-2]);
> --
> 2.29.1.341.ge80a0c044ae-goog
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 1/8] bpf: Implement task local storage
2020-11-03 23:47 ` Song Liu
@ 2020-11-03 23:54 ` KP Singh
0 siblings, 0 replies; 28+ messages in thread
From: KP Singh @ 2020-11-03 23:54 UTC (permalink / raw)
To: Song Liu
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
On Wed, Nov 4, 2020 at 12:47 AM Song Liu <songliubraving@fb.com> wrote:
>
>
> > On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
> >
> > From: KP Singh <kpsingh@google.com>
> >
> > Similar to bpf_local_storage for sockets and inodes add local storage
> > for task_struct.
> >
> > The life-cycle of storage is managed with the life-cycle of the
> > task_struct. i.e. the storage is destroyed along with the owning task
> > with a callback to the bpf_task_storage_free from the task_free LSM
> > hook.
> >
> > The BPF LSM allocates an __rcu pointer to the bpf_local_storage in
> > the security blob which are now stackable and can co-exist with other
> > LSMs.
> >
> > The userspace map operations can be done by using a pid fd as a key
> > passed to the lookup, update and delete operations.
> >
> > Signed-off-by: KP Singh <kpsingh@google.com>
>
> Acked-by: Song Liu <songliubraving@fb.com>
>
> with a few nits:
>
> > ---
> > include/linux/bpf_lsm.h | 23 +++
> > include/linux/bpf_types.h | 1 +
> > include/uapi/linux/bpf.h | 39 ++++
> > kernel/bpf/Makefile | 1 +
> > kernel/bpf/bpf_lsm.c | 4 +
> > kernel/bpf/bpf_task_storage.c | 313 +++++++++++++++++++++++++++++++++
> > kernel/bpf/syscall.c | 3 +-
> > kernel/bpf/verifier.c | 10 ++
> > security/bpf/hooks.c | 2 +
> > tools/include/uapi/linux/bpf.h | 39 ++++
> > 10 files changed, 434 insertions(+), 1 deletion(-)
> > create mode 100644 kernel/bpf/bpf_task_storage.c
> >
> > diff --git a/include/linux/bpf_lsm.h b/include/linux/bpf_lsm.h
> > index aaacb6aafc87..326cb68a3632 100644
> > --- a/include/linux/bpf_lsm.h
> > +++ b/include/linux/bpf_lsm.h
> > @@ -7,6 +7,7 @@
> > #ifndef _LINUX_BPF_LSM_H
> > #define _LINUX_BPF_LSM_H
> >
> > +#include "linux/sched.h"
>
> vscode?
Yep, turns out it was clangd (which I use in vscode) and I needed to
pass "--header-insertion=never"
when starting the clangd server, I fixed all other instances as well.
- KP
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID
2020-11-03 15:31 ` [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID KP Singh
@ 2020-11-03 23:57 ` Song Liu
0 siblings, 0 replies; 28+ messages in thread
From: Song Liu @ 2020-11-03 23:57 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> The currently available bpf_get_current_task returns an unsigned integer
> which can be used along with BPF_CORE_READ to read data from
> the task_struct but still cannot be used as an input argument to a
> helper that accepts an ARG_PTR_TO_BTF_ID of type task_struct.
>
> In order to implement this helper a new return type, RET_PTR_TO_BTF_ID,
> is added. This is similar to RET_PTR_TO_BTF_ID_OR_NULL but does not
> require checking the nullness of returned pointer.
>
> Signed-off-by: KP Singh <kpsingh@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
> ---
> include/linux/bpf.h | 1 +
> include/uapi/linux/bpf.h | 9 +++++++++
> kernel/bpf/verifier.c | 7 +++++--
> kernel/trace/bpf_trace.c | 16 ++++++++++++++++
> tools/include/uapi/linux/bpf.h | 9 +++++++++
> 5 files changed, 40 insertions(+), 2 deletions(-)
>
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index 2fffd30e13ac..73d5381a5d5c 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -310,6 +310,7 @@ enum bpf_return_type {
> RET_PTR_TO_BTF_ID_OR_NULL, /* returns a pointer to a btf_id or NULL */
> RET_PTR_TO_MEM_OR_BTF_ID_OR_NULL, /* returns a pointer to a valid memory or a btf_id or NULL */
> RET_PTR_TO_MEM_OR_BTF_ID, /* returns a pointer to a valid memory or a btf_id */
> + RET_PTR_TO_BTF_ID, /* returns a pointer to a btf_id */
> };
>
> /* eBPF function prototype used by verifier to allow BPF_CALLs from eBPF programs
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index f4037b2161a6..9879d6793e90 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -3779,6 +3779,14 @@ union bpf_attr {
> * 0 on success.
> *
> * **-ENOENT** if the bpf_local_storage cannot be found.
> + *
> + * struct task_struct *bpf_get_current_task_btf(void)
> + * Description
> + * Return a BTF pointer to the "current" task.
> + * This pointer can also be used in helpers that accept an
> + * *ARG_PTR_TO_BTF_ID* of type *task_struct*.
> + * Return
> + * Pointer to the current task.
> */
> #define __BPF_FUNC_MAPPER(FN) \
> FN(unspec), \
> @@ -3939,6 +3947,7 @@ union bpf_attr {
> FN(redirect_peer), \
> FN(task_storage_get), \
> FN(task_storage_delete), \
> + FN(get_current_task_btf), \
> /* */
>
> /* integer value in 'imm' field of BPF_CALL instruction selects which helper
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b0790876694f..314018e8fc12 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5186,11 +5186,14 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
> PTR_TO_BTF_ID : PTR_TO_BTF_ID_OR_NULL;
> regs[BPF_REG_0].btf_id = meta.ret_btf_id;
> }
> - } else if (fn->ret_type == RET_PTR_TO_BTF_ID_OR_NULL) {
> + } else if (fn->ret_type == RET_PTR_TO_BTF_ID_OR_NULL ||
> + fn->ret_type == RET_PTR_TO_BTF_ID) {
> int ret_btf_id;
>
> mark_reg_known_zero(env, regs, BPF_REG_0);
> - regs[BPF_REG_0].type = PTR_TO_BTF_ID_OR_NULL;
> + regs[BPF_REG_0].type = fn->ret_type == RET_PTR_TO_BTF_ID ?
> + PTR_TO_BTF_ID :
> + PTR_TO_BTF_ID_OR_NULL;
> ret_btf_id = *fn->ret_btf_id;
> if (ret_btf_id == 0) {
> verbose(env, "invalid return type %d of func %s#%d\n",
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 4517c8b66518..e4515b0f62a8 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -1022,6 +1022,20 @@ const struct bpf_func_proto bpf_get_current_task_proto = {
> .ret_type = RET_INTEGER,
> };
>
> +BPF_CALL_0(bpf_get_current_task_btf)
> +{
> + return (unsigned long) current;
> +}
> +
> +BTF_ID_LIST_SINGLE(bpf_get_current_btf_ids, struct, task_struct)
> +
> +static const struct bpf_func_proto bpf_get_current_task_btf_proto = {
> + .func = bpf_get_current_task_btf,
> + .gpl_only = true,
> + .ret_type = RET_PTR_TO_BTF_ID,
> + .ret_btf_id = &bpf_get_current_btf_ids[0],
> +};
> +
> BPF_CALL_2(bpf_current_task_under_cgroup, struct bpf_map *, map, u32, idx)
> {
> struct bpf_array *array = container_of(map, struct bpf_array, map);
> @@ -1265,6 +1279,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
> return &bpf_get_current_pid_tgid_proto;
> case BPF_FUNC_get_current_task:
> return &bpf_get_current_task_proto;
> + case BPF_FUNC_get_current_task_btf:
> + return &bpf_get_current_task_btf_proto;
> case BPF_FUNC_get_current_uid_gid:
> return &bpf_get_current_uid_gid_proto;
> case BPF_FUNC_get_current_comm:
> diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
> index f4037b2161a6..9879d6793e90 100644
> --- a/tools/include/uapi/linux/bpf.h
> +++ b/tools/include/uapi/linux/bpf.h
> @@ -3779,6 +3779,14 @@ union bpf_attr {
> * 0 on success.
> *
> * **-ENOENT** if the bpf_local_storage cannot be found.
> + *
> + * struct task_struct *bpf_get_current_task_btf(void)
> + * Description
> + * Return a BTF pointer to the "current" task.
> + * This pointer can also be used in helpers that accept an
> + * *ARG_PTR_TO_BTF_ID* of type *task_struct*.
> + * Return
> + * Pointer to the current task.
> */
> #define __BPF_FUNC_MAPPER(FN) \
> FN(unspec), \
> @@ -3939,6 +3947,7 @@ union bpf_attr {
> FN(redirect_peer), \
> FN(task_storage_get), \
> FN(task_storage_delete), \
> + FN(get_current_task_btf), \
> /* */
>
> /* integer value in 'imm' field of BPF_CALL instruction selects which helper
> --
> 2.29.1.341.ge80a0c044ae-goog
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-03 18:59 ` KP Singh
@ 2020-11-04 0:05 ` KP Singh
2020-11-04 1:27 ` Alexei Starovoitov
0 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-04 0:05 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 7:59 PM KP Singh <kpsingh@chromium.org> wrote:
>
> On Tue, Nov 3, 2020 at 7:47 PM Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Tue, Nov 03, 2020 at 04:31:31PM +0100, KP Singh wrote:
> > > +
> > > +struct storage {
> > > + void *inode;
> > > + unsigned int value;
> > > + /* Lock ensures that spin locked versions of local stoage operations
> > > + * also work, most operations in this tests are still single threaded
> > > + */
> > > + struct bpf_spin_lock lock;
> > > +};
> >
> > I think it's a good idea to test spin_lock in local_storage,
> > but it seems the test is not doing it fully.
> > It's only adding it to the storage, but the program is not accessing it.
>
> I added it here just to check if the offset calculations (map->spin_lock_off)
> are correctly happening for these new maps.
>
> As mentioned in the updates, I do intend to generalize
> tools/testing/selftests/bpf/map_tests/sk_storage_map.c which already has
> the threading logic to exercise bpf_spin_lock in storage maps.
>
Actually, after I added simple bpf_spin_{lock, unlock} to the test programs, I
ended up realizing that we have not exposed spin locks to LSM programs
for now, this is because they inherit the tracing helpers.
I saw the docs mention that these are not exposed to tracing programs due to
insufficient preemption checks. Do you think it would be okay to allow them
for LSM programs?
- KP
> Hope this is an okay plan?
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage
2020-11-03 15:31 ` [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage KP Singh
@ 2020-11-04 0:16 ` Song Liu
0 siblings, 0 replies; 28+ messages in thread
From: Song Liu @ 2020-11-04 0:16 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> The {inode,sk}_storage_result checking if the correct value was retrieved
> was being clobbered unconditionally by the return value of the
> bpf_{inode,sk}_storage_delete call.
>
> Also, consistently use the newly added BPF_LOCAL_STORAGE_GET_F_CREATE
> flag.
>
> Fixes: cd324d7abb3d ("bpf: Add selftests for local_storage")
> Signed-off-by: KP Singh <kpsingh@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
[...]
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h
2020-11-03 15:31 ` [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h KP Singh
@ 2020-11-04 0:16 ` Song Liu
0 siblings, 0 replies; 28+ messages in thread
From: Song Liu @ 2020-11-04 0:16 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann, Martin Lau,
Paul Turner, Jann Horn, Hao Luo
> On Nov 3, 2020, at 7:31 AM, KP Singh <kpsingh@chromium.org> wrote:
>
> From: KP Singh <kpsingh@google.com>
>
> With the fixing of BTF pruning of embedded types being fixed, the test
> can be simplified to use vmlinux.h
>
> Signed-off-by: KP Singh <kpsingh@google.com>
Acked-by: Song Liu <songliubraving@fb.com>
> ---
> .../selftests/bpf/progs/local_storage.c | 20 +------------------
> 1 file changed, 1 insertion(+), 19 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/progs/local_storage.c b/tools/testing/selftests/bpf/progs/local_storage.c
> index 09529e33be98..ef3822bc7542 100644
> --- a/tools/testing/selftests/bpf/progs/local_storage.c
> +++ b/tools/testing/selftests/bpf/progs/local_storage.c
> @@ -4,9 +4,8 @@
> * Copyright 2020 Google LLC.
> */
>
> +#include "vmlinux.h"
> #include <errno.h>
> -#include <linux/bpf.h>
> -#include <stdbool.h>
> #include <bpf/bpf_helpers.h>
> #include <bpf/bpf_tracing.h>
>
> @@ -36,23 +35,6 @@ struct {
> __type(value, struct dummy_storage);
> } sk_storage_map SEC(".maps");
>
> -/* TODO Use vmlinux.h once BTF pruning for embedded types is fixed.
> - */
> -struct sock {} __attribute__((preserve_access_index));
> -struct sockaddr {} __attribute__((preserve_access_index));
> -struct socket {
> - struct sock *sk;
> -} __attribute__((preserve_access_index));
> -
> -struct inode {} __attribute__((preserve_access_index));
> -struct dentry {
> - struct inode *d_inode;
> -} __attribute__((preserve_access_index));
> -struct file {
> - struct inode *f_inode;
> -} __attribute__((preserve_access_index));
> -
> -
> SEC("lsm/inode_unlink")
> int BPF_PROG(unlink_hook, struct inode *dir, struct dentry *victim)
> {
> --
> 2.29.1.341.ge80a0c044ae-goog
>
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 0:05 ` KP Singh
@ 2020-11-04 1:27 ` Alexei Starovoitov
2020-11-04 1:55 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: Alexei Starovoitov @ 2020-11-04 1:27 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 4:05 PM KP Singh <kpsingh@chromium.org> wrote:
>
> On Tue, Nov 3, 2020 at 7:59 PM KP Singh <kpsingh@chromium.org> wrote:
> >
> > On Tue, Nov 3, 2020 at 7:47 PM Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >
> > > On Tue, Nov 03, 2020 at 04:31:31PM +0100, KP Singh wrote:
> > > > +
> > > > +struct storage {
> > > > + void *inode;
> > > > + unsigned int value;
> > > > + /* Lock ensures that spin locked versions of local stoage operations
> > > > + * also work, most operations in this tests are still single threaded
> > > > + */
> > > > + struct bpf_spin_lock lock;
> > > > +};
> > >
> > > I think it's a good idea to test spin_lock in local_storage,
> > > but it seems the test is not doing it fully.
> > > It's only adding it to the storage, but the program is not accessing it.
> >
> > I added it here just to check if the offset calculations (map->spin_lock_off)
> > are correctly happening for these new maps.
> >
> > As mentioned in the updates, I do intend to generalize
> > tools/testing/selftests/bpf/map_tests/sk_storage_map.c which already has
> > the threading logic to exercise bpf_spin_lock in storage maps.
> >
>
> Actually, after I added simple bpf_spin_{lock, unlock} to the test programs, I
> ended up realizing that we have not exposed spin locks to LSM programs
> for now, this is because they inherit the tracing helpers.
>
> I saw the docs mention that these are not exposed to tracing programs due to
> insufficient preemption checks. Do you think it would be okay to allow them
> for LSM programs?
hmm. Isn't it allowed already?
The verifier does:
if ((is_tracing_prog_type(prog_type) ||
prog_type == BPF_PROG_TYPE_SOCKET_FILTER) &&
map_value_has_spin_lock(map)) {
verbose(env, "tracing progs cannot use bpf_spin_lock yet\n");
return -EINVAL;
}
BPF_PROG_TYPE_LSM is not in this list.
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 1:27 ` Alexei Starovoitov
@ 2020-11-04 1:55 ` KP Singh
2020-11-04 1:57 ` Alexei Starovoitov
0 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-04 1:55 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
[...]
> >
> > I saw the docs mention that these are not exposed to tracing programs due to
> > insufficient preemption checks. Do you think it would be okay to allow them
> > for LSM programs?
>
> hmm. Isn't it allowed already?
> The verifier does:
> if ((is_tracing_prog_type(prog_type) ||
> prog_type == BPF_PROG_TYPE_SOCKET_FILTER) &&
> map_value_has_spin_lock(map)) {
> verbose(env, "tracing progs cannot use bpf_spin_lock yet\n");
> return -EINVAL;
> }
>
> BPF_PROG_TYPE_LSM is not in this list.
The verifier does not have any problem, it's just that the helpers are not
exposed to LSM programs via bpf_lsm_func_proto.
So all we need is:
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 61f8cc52fd5b..93383df2140b 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -63,6 +63,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const
struct bpf_prog *prog)
return &bpf_task_storage_get_proto;
case BPF_FUNC_task_storage_delete:
return &bpf_task_storage_delete_proto;
+ case BPF_FUNC_spin_lock:
+ return &bpf_spin_lock_proto;
+ case BPF_FUNC_spin_unlock:
+ return &bpf_spin_unlock_proto;
default:
return tracing_prog_func_proto(func_id, prog);
}
^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 1:55 ` KP Singh
@ 2020-11-04 1:57 ` Alexei Starovoitov
2020-11-04 6:51 ` John Fastabend
0 siblings, 1 reply; 28+ messages in thread
From: Alexei Starovoitov @ 2020-11-04 1:57 UTC (permalink / raw)
To: KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
On Tue, Nov 3, 2020 at 5:55 PM KP Singh <kpsingh@chromium.org> wrote:
>
> [...]
>
> > >
> > > I saw the docs mention that these are not exposed to tracing programs due to
> > > insufficient preemption checks. Do you think it would be okay to allow them
> > > for LSM programs?
> >
> > hmm. Isn't it allowed already?
> > The verifier does:
> > if ((is_tracing_prog_type(prog_type) ||
> > prog_type == BPF_PROG_TYPE_SOCKET_FILTER) &&
> > map_value_has_spin_lock(map)) {
> > verbose(env, "tracing progs cannot use bpf_spin_lock yet\n");
> > return -EINVAL;
> > }
> >
> > BPF_PROG_TYPE_LSM is not in this list.
>
> The verifier does not have any problem, it's just that the helpers are not
> exposed to LSM programs via bpf_lsm_func_proto.
>
> So all we need is:
>
> diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
> index 61f8cc52fd5b..93383df2140b 100644
> --- a/kernel/bpf/bpf_lsm.c
> +++ b/kernel/bpf/bpf_lsm.c
> @@ -63,6 +63,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const
> struct bpf_prog *prog)
> return &bpf_task_storage_get_proto;
> case BPF_FUNC_task_storage_delete:
> return &bpf_task_storage_delete_proto;
> + case BPF_FUNC_spin_lock:
> + return &bpf_spin_lock_proto;
> + case BPF_FUNC_spin_unlock:
> + return &bpf_spin_unlock_proto;
Ahh. Yes. That should do it. Right now I don't see concerns with safety
of the bpf_spin_lock in bpf_lsm progs.
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 1:57 ` Alexei Starovoitov
@ 2020-11-04 6:51 ` John Fastabend
2020-11-04 11:03 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: John Fastabend @ 2020-11-04 6:51 UTC (permalink / raw)
To: Alexei Starovoitov, KP Singh
Cc: open list, bpf, Alexei Starovoitov, Daniel Borkmann,
Martin KaFai Lau, Song Liu, Paul Turner, Jann Horn, Hao Luo
Alexei Starovoitov wrote:
> On Tue, Nov 3, 2020 at 5:55 PM KP Singh <kpsingh@chromium.org> wrote:
> >
> > [...]
> >
> > > >
> > > > I saw the docs mention that these are not exposed to tracing programs due to
> > > > insufficient preemption checks. Do you think it would be okay to allow them
> > > > for LSM programs?
> > >
> > > hmm. Isn't it allowed already?
> > > The verifier does:
> > > if ((is_tracing_prog_type(prog_type) ||
> > > prog_type == BPF_PROG_TYPE_SOCKET_FILTER) &&
> > > map_value_has_spin_lock(map)) {
> > > verbose(env, "tracing progs cannot use bpf_spin_lock yet\n");
> > > return -EINVAL;
> > > }
> > >
> > > BPF_PROG_TYPE_LSM is not in this list.\f
> >
> > The verifier does not have any problem, it's just that the helpers are not
> > exposed to LSM programs via bpf_lsm_func_proto.
> >
> > So all we need is:
> >
> > diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
> > index 61f8cc52fd5b..93383df2140b 100644
> > --- a/kernel/bpf/bpf_lsm.c
> > +++ b/kernel/bpf/bpf_lsm.c
> > @@ -63,6 +63,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const
> > struct bpf_prog *prog)
> > return &bpf_task_storage_get_proto;
> > case BPF_FUNC_task_storage_delete:
> > return &bpf_task_storage_delete_proto;
> > + case BPF_FUNC_spin_lock:
> > + return &bpf_spin_lock_proto;
> > + case BPF_FUNC_spin_unlock:
> > + return &bpf_spin_unlock_proto;
>
> Ahh. Yes. That should do it. Right now I don't see concerns with safety
> of the bpf_spin_lock in bpf_lsm progs.
What about sleepable lsm hooks? Normally we wouldn't expect to sleep with
a spinlock held. Should we have a check to ensure programs bpf_spin_lock
are not also sleepable?
^ permalink raw reply [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 6:51 ` John Fastabend
@ 2020-11-04 11:03 ` KP Singh
2020-11-04 11:11 ` KP Singh
0 siblings, 1 reply; 28+ messages in thread
From: KP Singh @ 2020-11-04 11:03 UTC (permalink / raw)
To: John Fastabend
Cc: Alexei Starovoitov, open list, bpf, Alexei Starovoitov,
Daniel Borkmann, Martin KaFai Lau, Song Liu, Paul Turner,
Jann Horn, Hao Luo
[...]
> > Ahh. Yes. That should do it. Right now I don't see concerns with safety
> > of the bpf_spin_lock in bpf_lsm progs.
>
> What about sleepable lsm hooks? Normally we wouldn't expect to sleep with
> a spinlock held. Should we have a check to ensure programs bpf_spin_lock
> are not also sleepable?
Thanks. Yes, I added that to my patch:
diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 61f8cc52fd5b..93383df2140b 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -63,6 +63,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const
struct bpf_prog *prog)
return &bpf_task_storage_get_proto;
case BPF_FUNC_task_storage_delete:
return &bpf_task_storage_delete_proto;
+ case BPF_FUNC_spin_lock:
+ return &bpf_spin_lock_proto;
+ case BPF_FUNC_spin_unlock:
+ return &bpf_spin_unlock_proto;
default:
return tracing_prog_func_proto(func_id, prog);
}
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 314018e8fc12..8892f7ba2041 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9739,6 +9739,23 @@ static int check_map_prog_compatibility(struct
bpf_verifier_env *env,
return -EINVAL;
}
+ if (map_value_has_spin_lock(map)) {
+ if (prog_type == BPF_PROG_TYPE_SOCKET_FILTER) {
+ verbose(env, "socket filter progs cannot use
bpf_spin_lock yet\n");
+ return -EINVAL;
+ }
+
+ if (is_tracing_prog_type(prog_type)) {
+ verbose(env, "tracing progs cannot use
bpf_spin_lock yet\n");
+ return -EINVAL;
+ }
+
+ if (prog->aux->sleepable) {
+ verbose(env, "sleepable progs cannot use
bpf_spin_lock\n");
+ return -EINVAL;
+ }
+ }
+
^ permalink raw reply related [flat|nested] 28+ messages in thread
* Re: [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage
2020-11-04 11:03 ` KP Singh
@ 2020-11-04 11:11 ` KP Singh
0 siblings, 0 replies; 28+ messages in thread
From: KP Singh @ 2020-11-04 11:11 UTC (permalink / raw)
To: John Fastabend
Cc: Alexei Starovoitov, open list, bpf, Alexei Starovoitov,
Daniel Borkmann, Martin KaFai Lau, Song Liu, Paul Turner,
Jann Horn, Hao Luo
On Wed, Nov 4, 2020 at 12:03 PM KP Singh <kpsingh@chromium.org> wrote:
>
> [...]
>
> > > Ahh. Yes. That should do it. Right now I don't see concerns with safety
> > > of the bpf_spin_lock in bpf_lsm progs.
> >
> > What about sleepable lsm hooks? Normally we wouldn't expect to sleep with
> > a spinlock held. Should we have a check to ensure programs bpf_spin_lock
> > are not also sleepable?
>
> Thanks. Yes, I added that to my patch:
>
> diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
> index 61f8cc52fd5b..93383df2140b 100644
> --- a/kernel/bpf/bpf_lsm.c
> +++ b/kernel/bpf/bpf_lsm.c
> @@ -63,6 +63,10 @@ bpf_lsm_func_proto(enum bpf_func_id func_id, const
> struct bpf_prog *prog)
> return &bpf_task_storage_get_proto;
> case BPF_FUNC_task_storage_delete:
> return &bpf_task_storage_delete_proto;
> + case BPF_FUNC_spin_lock:
> + return &bpf_spin_lock_proto;
> + case BPF_FUNC_spin_unlock:
> + return &bpf_spin_unlock_proto;
> default:
> return tracing_prog_func_proto(func_id, prog);
> }
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 314018e8fc12..8892f7ba2041 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9739,6 +9739,23 @@ static int check_map_prog_compatibility(struct
> bpf_verifier_env *env,
> return -EINVAL;
> }
>
> + if (map_value_has_spin_lock(map)) {
> + if (prog_type == BPF_PROG_TYPE_SOCKET_FILTER) {
> + verbose(env, "socket filter progs cannot use
> bpf_spin_lock yet\n");
> + return -EINVAL;
> + }
> +
> + if (is_tracing_prog_type(prog_type)) {
> + verbose(env, "tracing progs cannot use
> bpf_spin_lock yet\n");
> + return -EINVAL;
> + }
> +
> + if (prog->aux->sleepable) {
> + verbose(env, "sleepable progs cannot use
> bpf_spin_lock\n");
I think this can still be "yet" as it's doable; we can disable/enable
preemption in the helpers
and then have the verifier track that no sleepable helper is called
when a spin lock is held.
I would, however, prefer if we do it in a subsequent patch.
- KP
> + return -EINVAL;
> + }
> + }
> +
^ permalink raw reply [flat|nested] 28+ messages in thread
end of thread, other threads:[~2020-11-04 11:11 UTC | newest]
Thread overview: 28+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-03 15:31 [PATCH bpf-next v2 0/8] Implement task_local_storage KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 1/8] bpf: Implement task local storage KP Singh
2020-11-03 23:47 ` Song Liu
2020-11-03 23:54 ` KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 2/8] libbpf: Add support for " KP Singh
2020-11-03 19:28 ` Andrii Nakryiko
2020-11-03 20:28 ` KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 3/8] bpftool: " KP Singh
2020-11-03 23:50 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 4/8] bpf: Implement get_current_task_btf and RET_PTR_TO_BTF_ID KP Singh
2020-11-03 23:57 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 5/8] bpf: Fix tests for local_storage KP Singh
2020-11-04 0:16 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 6/8] bpf: Update selftests for local_storage to use vmlinux.h KP Singh
2020-11-04 0:16 ` Song Liu
2020-11-03 15:31 ` [PATCH bpf-next v2 7/8] bpf: Add tests for task_local_storage KP Singh
2020-11-03 18:47 ` Alexei Starovoitov
2020-11-03 18:59 ` KP Singh
2020-11-04 0:05 ` KP Singh
2020-11-04 1:27 ` Alexei Starovoitov
2020-11-04 1:55 ` KP Singh
2020-11-04 1:57 ` Alexei Starovoitov
2020-11-04 6:51 ` John Fastabend
2020-11-04 11:03 ` KP Singh
2020-11-04 11:11 ` KP Singh
2020-11-03 15:31 ` [PATCH bpf-next v2 8/8] bpf: Exercise syscall operations for inode and sk storage KP Singh
2020-11-03 22:32 ` Song Liu
2020-11-03 22:58 ` KP Singh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).