Re: [PATCH] bpf: Add network namespace boundary inspection kfuncs

[bot+bpf-ci]

> bpf: Add network namespace boundary inspection kfuncs

TL;DR: The new kfuncs sit inside the CONFIG_CGROUPS block but their
BTF_ID_FLAGS entries don't. With CONFIG_NET=y and CONFIG_CGROUPS=n,
resolve_btfids may fail the link or kfunc registration may abort, possibly
dropping other kfuncs.

> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c

[ ... ]

> @@ -2991,6 +2994,77 @@ __bpf_kfunc long bpf_task_under_cgroup(struct task_struct *task,
>  	return ret;
>  }
>  
> +#ifdef CONFIG_NET
> +/**
> + * bpf_task_is_init_net - check whether task belongs to initial network namespace

[ ... ]

> +__bpf_kfunc bool bpf_sock_is_init_net(const struct sock *sk)
> +{
> +	if (!sk)
> +		return false;
> +
> +	return net_eq(sock_net(sk), &init_net);
> +}
> +#endif /* CONFIG_NET */
> +

[ ... ]

> @@ -5151,6 +5225,11 @@ BTF_ID_FLAGS(func, bpf_cgroup_from_id, KF_ACQUIRE | KF_RET_NULL)
>  BTF_ID_FLAGS(func, bpf_task_under_cgroup, KF_RCU)
>  BTF_ID_FLAGS(func, bpf_task_get_cgroup1, KF_ACQUIRE | KF_RCU | KF_RET_NULL)
>  #endif
> +#ifdef CONFIG_NET
> +BTF_ID_FLAGS(func, bpf_task_is_init_net, KF_RCU)
> +BTF_ID_FLAGS(func, bpf_task_get_netns_inum, KF_RCU)
> +BTF_ID_FLAGS(func, bpf_sock_is_init_net, KF_RCU)
> +#endif

Are these three kfunc definitions compiled when CONFIG_CGROUPS is not set?

The definitions sit inside the existing CONFIG_CGROUPS block, which is
closed by the "#endif /* CONFIG_CGROUPS */" after bpf_task_get_cgroup1()
and friends, but the BTF_ID_FLAGS() entries are guarded only by
CONFIG_NET and come after the CONFIG_CGROUPS #endif.

With CONFIG_NET=y, CONFIG_CGROUPS=n and CONFIG_DEBUG_INFO_BTF=y, the
functions are not built but generic_btf_ids still names them.  Then
resolve_btfids prints "unresolved symbol bpf_task_is_init_net" for each
of them, and the vmlinux link can fail when CONFIG_WERROR is set.

Without CONFIG_WERROR, the set8 entries keep BTF id 0.  At boot,
kfunc_init() calls register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING,
&generic_kfunc_set), and btf_check_kfunc_protos() sees btf_type_by_id(btf, 0)
as the void type and returns -EINVAL:

    if (!btf_type_is_func(func))
        return -EINVAL;

The "ret ?:" chain in kfunc_init() then skips every later registration
(SCHED_CLS, XDP, STRUCT_OPS, SYSCALL, CGROUP_SKB, the dtors and
common_kfunc_set).  Could that drop kfuncs such as bpf_obj_new(),
bpf_task_acquire() and bpf_rcu_read_lock() on such configs?

Should the new definitions be moved after the CONFIG_CGROUPS #endif, so
they match the scope of the BTF_ID_FLAGS() entries?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/42028225169