Re: [PATCH bpf-next v2 2/6] bpf: Introduce css_task open-coded iterator kfuncs

[Chuyi Zhou]

Hello, Alexei.

在 2023/9/13 01:13, Alexei Starovoitov 写道:
> On Tue, Sep 12, 2023 at 03:01:45PM +0800, Chuyi Zhou wrote:
> > This patch adds kfuncs bpf_iter_css_task_{new,next,destroy} which allow
> > creation and manipulation of struct bpf_iter_css_task in open-coded
> > iterator style. These kfuncs actually wrapps css_task_iter_{start,next,
> > end}. BPF programs can use these kfuncs through bpf_for_each macro for
> > iteration of all tasks under a css.
> >
> > css_task_iter_*() would try to get the global spin-lock *css_set_lock*, so
> > the bpf side has to be careful in where it allows to use this iter.
> > Currently we only allow it in bpf_lsm and bpf iter-s.
> >
> > Signed-off-by: Chuyi Zhou <zhouchuyi@xxxxxxxxxxxxx>
> > ---
> >   include/uapi/linux/bpf.h       |  4 +++
> >   kernel/bpf/helpers.c           |  3 +++
> >   kernel/bpf/task_iter.c         | 48 ++++++++++++++++++++++++++++++++++
> >   kernel/bpf/verifier.c          | 23 ++++++++++++++++
> >   tools/include/uapi/linux/bpf.h |  4 +++
> >   tools/lib/bpf/bpf_helpers.h    |  7 +++++
> >   6 files changed, 89 insertions(+)
> >
> > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> > index 73b155e52204..de02c0971428 100644
> > --- a/include/uapi/linux/bpf.h
> > +++ b/include/uapi/linux/bpf.h
> > @@ -7318,4 +7318,8 @@ struct bpf_iter_num {
> >   	__u64 __opaque[1];
> >   } __attribute__((aligned(8)));
> >   
> > +struct bpf_iter_css_task {
> > +	__u64 __opaque[1];
> > +} __attribute__((aligned(8)));
> > +
> >   #endif /* _UAPI__LINUX_BPF_H__ */
> > diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> > index b0a9834f1051..d6a16becfbb9 100644
> > --- a/kernel/bpf/helpers.c
> > +++ b/kernel/bpf/helpers.c
> > @@ -2504,6 +2504,9 @@ BTF_ID_FLAGS(func, bpf_dynptr_slice_rdwr, KF_RET_NULL)
> >   BTF_ID_FLAGS(func, bpf_iter_num_new, KF_ITER_NEW)
> >   BTF_ID_FLAGS(func, bpf_iter_num_next, KF_ITER_NEXT | KF_RET_NULL)
> >   BTF_ID_FLAGS(func, bpf_iter_num_destroy, KF_ITER_DESTROY)
> > +BTF_ID_FLAGS(func, bpf_iter_css_task_new, KF_ITER_NEW)
>
> Looking at selftest:
> struct cgroup_subsys_state *css = &cgrp->self;
>
> realized that we're missing KF_TRUSTED_ARGS here.
>
> > +BTF_ID_FLAGS(func, bpf_iter_css_task_next, KF_ITER_NEXT | KF_RET_NULL)
> > +BTF_ID_FLAGS(func, bpf_iter_css_task_destroy, KF_ITER_DESTROY)
> >   BTF_ID_FLAGS(func, bpf_dynptr_adjust)
> >   BTF_ID_FLAGS(func, bpf_dynptr_is_null)
> >   BTF_ID_FLAGS(func, bpf_dynptr_is_rdonly)
> > diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c
> > index 7473068ed313..d8539cc05ffd 100644
> > --- a/kernel/bpf/task_iter.c
> > +++ b/kernel/bpf/task_iter.c
> > @@ -803,6 +803,54 @@ const struct bpf_func_proto bpf_find_vma_proto = {
> >   	.arg5_type	= ARG_ANYTHING,
> >   };
> >   
> > +struct bpf_iter_css_task_kern {
> > +	struct css_task_iter *css_it;
> > +} __attribute__((aligned(8)));
> > +
> > +__bpf_kfunc int bpf_iter_css_task_new(struct bpf_iter_css_task *it,
> > +		struct cgroup_subsys_state *css, unsigned int flags)
>
> the verifier does a type check, but it's not strong enough.
> We need KF_TRUSTED_ARGS to make sure the pointer is valid.
> The BTF_TYPE_SAFE_RCU(struct cgroup) {
> probably doesn't need to change, since '&cgrp->self' is not a pointer deref.
> The verifier should understand that cgroup_subsys_state is also PTR_TRUSTED
> just like 'cgrp' pointer.

Got it. It seems we should also apply this to bpf_iter_css_{pre,post}_new.

> Also please add negative tests in patch 6.
> Like doing bpf_rcu_read_unlock() in the middle and check that the verifier
> catches such mistake.

I will do it in next version.

Thanks.