[net-next,1/2] bpf: save extended inner map info for percpu array maps as well

Commit Message

Andrii Nakryiko May 15, 2024, 6:24 a.m. UTC

ARRAY_OF_MAPS and HASH_OF_MAPS map types have special logic to save
a few extra fields required for correct operations of ARRAY maps, when
they are used as inner maps. PERCPU_ARRAY maps have similar
requirements as they now support generating inline element lookup
logic. So make sure that both classes of maps are handled correctly.

Reported-by: Jakub Kicinski <[e-mail]>
Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps")
Signed-off-by: Andrii Nakryiko <[e-mail]>
---
 kernel/bpf/map_in_map.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Kumar Kartikeya Dwivedi May 15, 2024, 3:25 p.m. UTC | #1

On Wed, 15 May 2024 at 08:24, Andrii Nakryiko <[e-mail]> wrote:
>
> ARRAY_OF_MAPS and HASH_OF_MAPS map types have special logic to save
> a few extra fields required for correct operations of ARRAY maps, when
> they are used as inner maps. PERCPU_ARRAY maps have similar
> requirements as they now support generating inline element lookup
> logic. So make sure that both classes of maps are handled correctly.
>
> Reported-by: Jakub Kicinski <[e-mail]>
> Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps")
> Signed-off-by: Andrii Nakryiko <[e-mail]>
> ---

Acked-by: Kumar Kartikeya Dwivedi <[e-mail]>

Alexei Starovoitov May 15, 2024, 4:55 p.m. UTC | #2

On Tue, May 14, 2024 at 11:24 PM Andrii Nakryiko <[e-mail]> wrote:
>
> ARRAY_OF_MAPS and HASH_OF_MAPS map types have special logic to save
> a few extra fields required for correct operations of ARRAY maps, when
> they are used as inner maps. PERCPU_ARRAY maps have similar
> requirements as they now support generating inline element lookup
> logic. So make sure that both classes of maps are handled correctly.
>
> Reported-by: Jakub Kicinski <[e-mail]>
> Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps")
> Signed-off-by: Andrii Nakryiko <[e-mail]>
> ---
>  kernel/bpf/map_in_map.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
> index 8ef269e66ba5..b4f18c85d7bc 100644
> --- a/kernel/bpf/map_in_map.c
> +++ b/kernel/bpf/map_in_map.c
> @@ -32,7 +32,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
>
>         inner_map_meta_size = sizeof(*inner_map_meta);
>         /* In some cases verifier needs to access beyond just base map. */
> -       if (inner_map->ops == &array_map_ops)
> +       if (inner_map->ops == &array_map_ops || inner_map->ops == &percpu_array_map_ops)
>                 inner_map_meta_size = sizeof(struct bpf_array);

Applied the fix to stop the bleeding,
but we need to fix this fragility long term.

[e-mail] May 15, 2024, 4:58 p.m. UTC | #3

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <[e-mail]>:

On Tue, 14 May 2024 23:24:39 -0700 you wrote:
> ARRAY_OF_MAPS and HASH_OF_MAPS map types have special logic to save
> a few extra fields required for correct operations of ARRAY maps, when
> they are used as inner maps. PERCPU_ARRAY maps have similar
> requirements as they now support generating inline element lookup
> logic. So make sure that both classes of maps are handled correctly.
> 
> Reported-by: Jakub Kicinski <[e-mail]>
> Fixes: db69718b8efa ("bpf: inline bpf_map_lookup_elem() for PERCPU_ARRAY maps")
> Signed-off-by: Andrii Nakryiko <[e-mail]>
> 
> [...]

Here is the summary with links:
  - [net-next,1/2] bpf: save extended inner map info for percpu array maps as well
    https://git.kernel.org/bpf/bpf/c/9ee982290831
  - [net-next,2/2] selftests/bpf: add more variations of map-in-map situations
    https://git.kernel.org/bpf/bpf/c/2322113ac9d0

You are awesome, thank you!

Patch

diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index 8ef269e66ba5..b4f18c85d7bc 100644
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c
@@ -32,7 +32,7 @@  struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 
 	inner_map_meta_size = sizeof(*inner_map_meta);
 	/* In some cases verifier needs to access beyond just base map. */
-	if (inner_map->ops == &array_map_ops)
+	if (inner_map->ops == &array_map_ops || inner_map->ops == &percpu_array_map_ops)
 		inner_map_meta_size = sizeof(struct bpf_array);
 
 	inner_map_meta = kzalloc(inner_map_meta_size, GFP_USER);
@@ -68,7 +68,7 @@  struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 
 	/* Misc members not needed in bpf_map_meta_equal() check. */
 	inner_map_meta->ops = inner_map->ops;
-	if (inner_map->ops == &array_map_ops) {
+	if (inner_map->ops == &array_map_ops || inner_map->ops == &percpu_array_map_ops) {
 		struct bpf_array *inner_array_meta =
 			container_of(inner_map_meta, struct bpf_array, map);
 		struct bpf_array *inner_array = container_of(inner_map, struct bpf_array, map);