Skip to content

Commit 578ce69

Browse files
tohojoAlexei Starovoitov
authored andcommitted
bpf: Add dummy type reference to nf_conn___init to fix type deduplication
The bpf_ct_set_nat_info() kfunc is defined in the nf_nat.ko module, and takes as a parameter the nf_conn___init struct, which is allocated through the bpf_xdp_ct_alloc() helper defined in the nf_conntrack.ko module. However, because kernel modules can't deduplicate BTF types between each other, and the nf_conn___init struct is not referenced anywhere in vmlinux BTF, this leads to two distinct BTF IDs for the same type (one in each module). This confuses the verifier, as described here: https://lore.kernel.org/all/87leoh372s.fsf@toke.dk/ As a workaround, add an explicit BTF_TYPE_EMIT for the type in net/filter.c, so the type definition gets included in vmlinux BTF. This way, both modules can refer to the same type ID (as they both build on top of vmlinux BTF), and the verifier is no longer confused. v2: - Use BTF_TYPE_EMIT (which is a statement so it has to be inside a function definition; use xdp_func_proto() for this, since this is mostly xdp-related). Fixes: 820dc05 ("net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c") Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20221201123939.696558-1-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
1 parent 41d76c7 commit 578ce69

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

net/core/filter.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
#include <net/tls.h>
8181
#include <net/xdp.h>
8282
#include <net/mptcp.h>
83+
#include <net/netfilter/nf_conntrack_bpf.h>
8384

8485
static const struct bpf_func_proto *
8586
bpf_sk_base_func_proto(enum bpf_func_id func_id);
@@ -7992,6 +7993,19 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
79927993
default:
79937994
return bpf_sk_base_func_proto(func_id);
79947995
}
7996+
7997+
#if IS_MODULE(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF_MODULES)
7998+
/* The nf_conn___init type is used in the NF_CONNTRACK kfuncs. The
7999+
* kfuncs are defined in two different modules, and we want to be able
8000+
* to use them interchangably with the same BTF type ID. Because modules
8001+
* can't de-duplicate BTF IDs between each other, we need the type to be
8002+
* referenced in the vmlinux BTF or the verifier will get confused about
8003+
* the different types. So we add this dummy type reference which will
8004+
* be included in vmlinux BTF, allowing both modules to refer to the
8005+
* same type ID.
8006+
*/
8007+
BTF_TYPE_EMIT(struct nf_conn___init);
8008+
#endif
79958009
}
79968010

79978011
const struct bpf_func_proto bpf_sock_map_update_proto __weak;

0 commit comments

Comments
 (0)