Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpf: allow cgroup progs to export custom retval to userspace #2362

Closed
wants to merge 5 commits into from
Closed

bpf: allow cgroup progs to export custom retval to userspace #2362

wants to merge 5 commits into from

Conversation

kernel-patches-bot
Copy link

Pull request for series with
subject: bpf: allow cgroup progs to export custom retval to userspace
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668

@kernel-patches-bot
Copy link
Author

Master branch: e63a023
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 5e22dd1
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 218d747
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: ca796fe
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: ca796fe
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 58d8a3f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: a5bebc4
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 2847993
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 2847993
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 7218c28
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 51a33c6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 5f60826
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 640a171
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 1372d34
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 775a64e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 775a64e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 775a64e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 86c7eca
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 000daa0
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 71a3cdf
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@kernel-patches-bot
Copy link
Author

Master branch: 0e3a1c9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

Nobody and others added 4 commits January 14, 2022 17:35
adding ci files
3570ff1
@zhuyifei1999
bpf: Make BPF_PROG_RUN_ARRAY return -err instead of allow boolean
af35c57 
Right now BPF_PROG_RUN_ARRAY and related macros return 1 or 0
for whether the prog array allows or rejects whatever is being
hooked. The caller of these macros then return -EPERM or continue
processing based on thw macro's return value. Unforunately this is
inflexible, since -EPERM is the only err that can be returned.

This patch should be a no-op; it prepares for the next patch. The
returning of the -EPERM is moved to inside the macros, so the outer
functions are directly returning what the macros returned if they
are non-zero.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
@zhuyifei1999
bpf: Move getsockopt retval to struct bpf_cg_run_ctx
ef56b21 
The retval value is moved to struct bpf_cg_run_ctx for ease of access
in different prog types with different context structs layouts. The
helper implementation (to be added in a later patch in the series) can
simply perform a container_of from current->bpf_ctx to retrieve
bpf_cg_run_ctx.

Unfortunately, there is no easy way to access the current task_struct
via the verifier BPF bytecode rewrite, aside from possibly calling a
helper, so a pointer to current task is added to struct bpf_sockopt_kern
so that the rewritten BPF bytecode can access struct bpf_cg_run_ctx with
an indirection.

For backward compatibility, if a getsockopt program rejects a syscall
by returning 0, an -EPERM will be generated, by having the
BPF_PROG_RUN_ARRAY_CG family macros automatically set the retval to
-EPERM. Unlike prior to this patch, this -EPERM will be visible to
ctx->retval for any other hooks down the line in the prog array.

Additionally, the restriction that getsockopt filters can only set
the retval to 0 is removed, considering that certain getsockopt
implementations may return optlen. Filters are now able to set the
value arbitrarily.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
@zhuyifei1999
bpf: Add cgroup helpers bpf_{get,set}_retval to get/set syscall retur…
2a4fba7 
…n value

The helpers continue to use int for retval because all the hooks
are int-returning rather than long-returning. The return value of
bpf_set_retval is int for future-proofing, in case in the future
there may be errors trying to set the retval.

After the previous patch, if a program rejects a syscall by
returning 0, an -EPERM will be generated no matter if the retval
is already set to -err. This patch change it being forced only if
retval is not -err. This is because we want to support, for
example, invoking bpf_set_retval(-EINVAL) and return 0, and have
the syscall return value be -EINVAL not -EPERM.

This change is reflected in the sockopt_sk test which has been
updated to assert the errno is EINVAL instead of the EPERM.
The eBPF prog has to explicitly bpf_set_retval(-EPERM) if EPERM
is wanted. I also removed the explicit mentions of EPERM in the
comments in the prog.

For BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY, the prior behavior is
that, if the return value is NET_XMIT_DROP, the packet is silently
dropped. We preserve this behavior for backward compatibility
reasons, so even if an errno is set, the errno does not return to
caller. However, setting a non-err to retval cannot propagate so
this is not allowed and we return a -EFAULT in that case.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
@kernel-patches-bot
Copy link
Author

Master branch: e80f2a0
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=602668
version: 3

@zhuyifei1999
selftests/bpf: Test bpf_{get,set}_retval behavior with cgroup/sockopt
a7ff573 
The tests checks how different ways of interacting with the helpers
(getting retval, setting EUNATCH, EISCONN, and legacy reject
returning 0 without setting retval), produce different results in
both the setsockopt syscall and the retval returned by the helper.
A few more tests verify the interaction between the retval of the
helper and the retval in getsockopt context.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
@kernel-patches-bot
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=596347 expired. Closing PR.

@kernel-patches-bot kernel-patches-bot deleted the series/596347=>bpf-next branch January 21, 2022 01:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next changes-requested V2
Projects
None yet
Milestone
No milestone
2 participants
@kernel-patches-bot @zhuyifei1999