From patchwork Fri Aug 26 16:52:35 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michal_Koutn=C3=BD?= X-Patchwork-Id: 12956308 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BF54ECAAA6 for ; Fri, 26 Aug 2022 16:53:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344625AbiHZQxB (ORCPT ); Fri, 26 Aug 2022 12:53:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57374 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240638AbiHZQxA (ORCPT ); Fri, 26 Aug 2022 12:53:00 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC922F22; Fri, 26 Aug 2022 09:52:59 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 84C471F938; Fri, 26 Aug 2022 16:52:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1661532778; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WiAwBHSULI+FTo4qfy3+3mhtUrcHKXxhKOkgtoN7B58=; b=WSzyydoTKHO/jQ41DTq4QqKpX9wedu7wj+UBK86xB8hAMsH2xhxwmBDemrXNbNqMB5cVpP B9jjLQ7d+HcXy0f6g0gbHQSA9Vc5mXoDqFV7DqPce9xNlmbD8kWI+aI/KqY7tcbHOu/cz1 mabZKKw6kXLtxviHnH+FIyGiykTHERE= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 4D52213A82; Fri, 26 Aug 2022 16:52:58 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id yMu5EWr6CGMofAAAMHmgww (envelope-from ); Fri, 26 Aug 2022 16:52:58 +0000 From: =?utf-8?q?Michal_Koutn=C3=BD?= To: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org Cc: Tejun Heo , Aditya Kali , Serge Hallyn , Roman Gushchin , Yonghong Song , Muneendra Kumar , Yosry Ahmed , Hao Luo Subject: [PATCH 1/4] cgroup: Honor caller's cgroup NS when resolving path Date: Fri, 26 Aug 2022 18:52:35 +0200 Message-Id: <20220826165238.30915-2-mkoutny@suse.com> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220826165238.30915-1-mkoutny@suse.com> References: <20220826165238.30915-1-mkoutny@suse.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org cgroup_get_from_path() is not widely used function. Its callers presume the path is resolved under cgroup namespace. (There is one caller currently and resolving in init NS won't make harm (netfilter). However, future users may be subject to different effects when resolving globally.) Since, there's currently no use for the global resolution, modify the existing function to take cgroup NS into account. Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces") Signed-off-by: Michal Koutný --- kernel/cgroup/cgroup.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 5f4502aa2b3b..1a8b50d15ebf 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6598,8 +6598,12 @@ struct cgroup *cgroup_get_from_path(const char *path) { struct kernfs_node *kn; struct cgroup *cgrp = ERR_PTR(-ENOENT); + struct cgroup *root_cgrp; - kn = kernfs_walk_and_get(cgrp_dfl_root.cgrp.kn, path); + spin_lock_irq(&css_set_lock); + root_cgrp = current_cgns_cgroup_from_root(&cgrp_dfl_root); + kn = kernfs_walk_and_get(root_cgrp->kn, path); + spin_unlock_irq(&css_set_lock); if (!kn) goto out; From patchwork Fri Aug 26 16:52:36 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michal_Koutn=C3=BD?= X-Patchwork-Id: 12956310 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BAE1ECAAA6 for ; Fri, 26 Aug 2022 16:53:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344796AbiHZQxE (ORCPT ); Fri, 26 Aug 2022 12:53:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344311AbiHZQxB (ORCPT ); Fri, 26 Aug 2022 12:53:01 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [IPv6:2001:67c:2178:6::1d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C21CB3D; Fri, 26 Aug 2022 09:53:00 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id BE3A81F940; Fri, 26 Aug 2022 16:52:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1661532778; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pqsTghk3lUf2zHqs/aiods7p+Uf7TePr7J7612j6zrs=; b=p34Dq3Vuy2HqGPFdeYH7O52fSFA8g/UAZmA7N24XfyIGdml3BtgZVdhx2Ej3Y+oAbrTlKY Ex0mtRWCzPU8+v7ioOeQRhqkNknKuL4HiP1/msumCtrA/zMXjEFZl3H51bRZznXNrCWaPm cepNDpurKY/9ucFIoDCyWyVnaQi/rus= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 86C8113A7E; Fri, 26 Aug 2022 16:52:58 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id OL79H2r6CGMofAAAMHmgww (envelope-from ); Fri, 26 Aug 2022 16:52:58 +0000 From: =?utf-8?q?Michal_Koutn=C3=BD?= To: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org Cc: Tejun Heo , Aditya Kali , Serge Hallyn , Roman Gushchin , Yonghong Song , Muneendra Kumar , Yosry Ahmed , Hao Luo Subject: [PATCH 2/4] cgroup: cgroup: Honor caller's cgroup NS when resolving cgroup id Date: Fri, 26 Aug 2022 18:52:36 +0200 Message-Id: <20220826165238.30915-3-mkoutny@suse.com> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220826165238.30915-1-mkoutny@suse.com> References: <20220826165238.30915-1-mkoutny@suse.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org Cgroup ids are resolved in the global scope. That may be needed sometime (in future) but currently it violates virtual view provided through cgroup namespaces. There are currently following users of the resolution: - fc_appid_store - bpf_iter_attach_cgroup - mem_cgroup_get_from_ino None of the is a called on behalf of kernel but the resolution is made with proper userspace context, hence the default to current->nsproxy makes sens. (This doesn't rule out cgroup_get_from_id with cgroup NS parameter in the future.) Since cgroup ids are defined on v2 hierarchy only, we simply check existence in the cgroup namespace by looking at ancestry on the default hierarchy. Fixes: 6b658c4863c1 ("scsi: cgroup: Add cgroup_get_from_id()") Signed-off-by: Michal Koutný --- kernel/cgroup/cgroup.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 1a8b50d15ebf..4ca90ee6b902 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6007,11 +6007,12 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) * cgroup_get_from_id : get the cgroup associated with cgroup id * @id: cgroup id * On success return the cgrp, on failure return NULL + * Only cgroups within current task's cgroup NS are valid. */ struct cgroup *cgroup_get_from_id(u64 id) { struct kernfs_node *kn; - struct cgroup *cgrp = NULL; + struct cgroup *cgrp = NULL, *root_cgrp; kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id); if (!kn) @@ -6024,8 +6025,18 @@ struct cgroup *cgroup_get_from_id(u64 id) cgrp = NULL; rcu_read_unlock(); - kernfs_put(kn); + + if (!cgrp) + goto out; + + spin_lock_irq(&css_set_lock); + root_cgrp = current_cgns_cgroup_from_root(&cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + if (!cgroup_is_descendant(cgrp, root_cgrp)) { + cgroup_put(cgrp); + cgrp = NULL; + } out: return cgrp; } From patchwork Fri Aug 26 16:52:37 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michal_Koutn=C3=BD?= X-Patchwork-Id: 12956311 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D7F7ECAAD6 for ; Fri, 26 Aug 2022 16:53:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344798AbiHZQxE (ORCPT ); Fri, 26 Aug 2022 12:53:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57392 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344476AbiHZQxB (ORCPT ); Fri, 26 Aug 2022 12:53:01 -0400 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6DCE3D13E; Fri, 26 Aug 2022 09:53:00 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 08C541F949; Fri, 26 Aug 2022 16:52:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1661532779; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ji1E7MsAjBcqVqSFC5OGyfterDo89Vpl5wgi0w24b2M=; b=Io6WW/lReFEVoh0tfyG65yeK5q597USr4Ezze431kIQSvyKY1QYxepjQxV3ql44sWtofbX hNVvKkQfzzU0rpNHiECt8GFBaNvlmnpadC5ihjwByiJMu3sJtF5lb5fx+HO9UYgkl9e49E KIrXDEF6vjiXxrjlkJq/9h74MgAHJDE= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id C0DE613A82; Fri, 26 Aug 2022 16:52:58 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id QDM2Lmr6CGMofAAAMHmgww (envelope-from ); Fri, 26 Aug 2022 16:52:58 +0000 From: =?utf-8?q?Michal_Koutn=C3=BD?= To: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org Cc: Tejun Heo , Aditya Kali , Serge Hallyn , Roman Gushchin , Yonghong Song , Muneendra Kumar , Yosry Ahmed , Hao Luo Subject: [PATCH 3/4] cgroup: Homogenize cgroup_get_from_id() return value Date: Fri, 26 Aug 2022 18:52:37 +0200 Message-Id: <20220826165238.30915-4-mkoutny@suse.com> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220826165238.30915-1-mkoutny@suse.com> References: <20220826165238.30915-1-mkoutny@suse.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org Cgroup id is user provided datum hence extend its return domain to include possible error reason (similar to cgroup_get_from_fd()). This change also fixes commit d4ccaf58a847 ("bpf: Introduce cgroup iter") that would use NULL instead of proper error handling in d4ccaf58a847 ("bpf: Introduce cgroup iter"). Additionally, neither of: fc_appid_store, bpf_iter_attach_cgroup, mem_cgroup_get_from_ino (callers of cgroup_get_from_fd) is built without CONFIG_CGROUPS (depends via CONFIG_BLK_CGROUP, direct, transitive CONFIG_MEMCG respectively) transitive, so drop the singular definition not needed with !CONFIG_CGROUPS. Fixes: d4ccaf58a847 ("bpf: Introduce cgroup iter") Signed-off-by: Michal Koutný --- block/blk-cgroup-fc-appid.c | 4 ++-- include/linux/cgroup.h | 5 ----- kernel/cgroup/cgroup.c | 4 ++-- mm/memcontrol.c | 4 ++-- 4 files changed, 6 insertions(+), 11 deletions(-) diff --git a/block/blk-cgroup-fc-appid.c b/block/blk-cgroup-fc-appid.c index 760a2e1878dd..842e5e1c0f3c 100644 --- a/block/blk-cgroup-fc-appid.c +++ b/block/blk-cgroup-fc-appid.c @@ -19,8 +19,8 @@ int blkcg_set_fc_appid(char *app_id, u64 cgrp_id, size_t app_id_len) return -EINVAL; cgrp = cgroup_get_from_id(cgrp_id); - if (!cgrp) - return -ENOENT; + if (IS_ERR(cgrp)) + return PTR_ERR(cgrp); css = cgroup_get_e_css(cgrp, &io_cgrp_subsys); if (!css) { ret = -ENOENT; diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index ed53bfe7c46c..b6a9528374a8 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -752,11 +752,6 @@ static inline bool task_under_cgroup_hierarchy(struct task_struct *task, static inline void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) {} - -static inline struct cgroup *cgroup_get_from_id(u64 id) -{ - return NULL; -} #endif /* !CONFIG_CGROUPS */ #ifdef CONFIG_CGROUPS diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 4ca90ee6b902..c0377726031f 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6006,7 +6006,7 @@ void cgroup_path_from_kernfs_id(u64 id, char *buf, size_t buflen) /* * cgroup_get_from_id : get the cgroup associated with cgroup id * @id: cgroup id - * On success return the cgrp, on failure return NULL + * On success return the cgrp or ERR_PTR on failure * Only cgroups within current task's cgroup NS are valid. */ struct cgroup *cgroup_get_from_id(u64 id) @@ -6038,7 +6038,7 @@ struct cgroup *cgroup_get_from_id(u64 id) cgrp = NULL; } out: - return cgrp; + return cgrp ?: ERR_PTR(-ENOENT); } EXPORT_SYMBOL_GPL(cgroup_get_from_id); diff --git a/mm/memcontrol.c b/mm/memcontrol.c index b69979c9ced5..86f5ca8c6fa6 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5110,8 +5110,8 @@ struct mem_cgroup *mem_cgroup_get_from_ino(unsigned long ino) struct mem_cgroup *memcg; cgrp = cgroup_get_from_id(ino); - if (!cgrp) - return ERR_PTR(-ENOENT); + if (IS_ERR(cgrp)) + return PTR_ERR(cgrp); css = cgroup_get_e_css(cgrp, &memory_cgrp_subsys); if (css) From patchwork Fri Aug 26 16:52:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michal_Koutn=C3=BD?= X-Patchwork-Id: 12956312 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C26A8ECAAD7 for ; Fri, 26 Aug 2022 16:53:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344801AbiHZQxF (ORCPT ); Fri, 26 Aug 2022 12:53:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344615AbiHZQxB (ORCPT ); Fri, 26 Aug 2022 12:53:01 -0400 Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E32212AD6; Fri, 26 Aug 2022 09:53:00 -0700 (PDT) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 46B12336B4; Fri, 26 Aug 2022 16:52:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1661532779; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FAT+HbYA8AiuL1IZx0uK6pAdzXLKQU6eTml9pacvrDQ=; b=E2icuEnaJOofHI7HbH7GmPRTqNDQ6cuVu/tzJk/IGT4qxLXxpxiP6CiTWWTXoomAMgmzvF TGmuEwwVED6BQApstrm0xs1lHvruBWuj+5qGkVD0r/BS56ypSf/s5S+2pF7FGbd52LDg+r HE5pByM8aeXv+r7JFPf/t20xJPO8E1A= Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 0BD7A13A7E; Fri, 26 Aug 2022 16:52:59 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id yB+PAWv6CGMofAAAMHmgww (envelope-from ); Fri, 26 Aug 2022 16:52:59 +0000 From: =?utf-8?q?Michal_Koutn=C3=BD?= To: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, bpf@vger.kernel.org Cc: Tejun Heo , Aditya Kali , Serge Hallyn , Roman Gushchin , Yonghong Song , Muneendra Kumar , Yosry Ahmed , Hao Luo Subject: [PATCH 4/4] cgroup/bpf: Honor cgroup NS in cgroup_iter for ancestors Date: Fri, 26 Aug 2022 18:52:38 +0200 Message-Id: <20220826165238.30915-5-mkoutny@suse.com> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220826165238.30915-1-mkoutny@suse.com> References: <20220826165238.30915-1-mkoutny@suse.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net The iterator with BPF_CGROUP_ITER_ANCESTORS_UP can traverse up across a cgroup namespace level, which may be surprising within a non-init cgroup namespace. Introduce and use a new cgroup_parent_ns() helper that stops according to cgroup namespace boundary. With BPF_CGROUP_ITER_ANCESTORS_UP. We use the cgroup namespace of the iterator caller, not that one of the creator (might be different, the former is relevant). Fixes: d4ccaf58a847 ("bpf: Introduce cgroup iter") Signed-off-by: Michal Koutný --- include/linux/cgroup.h | 3 +++ kernel/bpf/cgroup_iter.c | 9 ++++++--- kernel/cgroup/cgroup.c | 32 +++++++++++++++++++++++--------- 3 files changed, 32 insertions(+), 12 deletions(-) diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index b6a9528374a8..b63a80e03fae 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -858,6 +858,9 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags, int cgroup_path_ns(struct cgroup *cgrp, char *buf, size_t buflen, struct cgroup_namespace *ns); +struct cgroup *cgroup_parent_ns(struct cgroup *cgrp, + struct cgroup_namespace *ns); + #else /* !CONFIG_CGROUPS */ static inline void free_cgroup_ns(struct cgroup_namespace *ns) { } diff --git a/kernel/bpf/cgroup_iter.c b/kernel/bpf/cgroup_iter.c index c69bce2f4403..06ee4a0c5870 100644 --- a/kernel/bpf/cgroup_iter.c +++ b/kernel/bpf/cgroup_iter.c @@ -104,6 +104,7 @@ static void *cgroup_iter_seq_next(struct seq_file *seq, void *v, loff_t *pos) { struct cgroup_subsys_state *curr = (struct cgroup_subsys_state *)v; struct cgroup_iter_priv *p = seq->private; + struct cgroup *parent; ++*pos; if (p->terminate) @@ -113,9 +114,11 @@ static void *cgroup_iter_seq_next(struct seq_file *seq, void *v, loff_t *pos) return css_next_descendant_pre(curr, p->start_css); else if (p->order == BPF_CGROUP_ITER_DESCENDANTS_POST) return css_next_descendant_post(curr, p->start_css); - else if (p->order == BPF_CGROUP_ITER_ANCESTORS_UP) - return curr->parent; - else /* BPF_CGROUP_ITER_SELF_ONLY */ + else if (p->order == BPF_CGROUP_ITER_ANCESTORS_UP) { + parent = cgroup_parent_ns(curr->cgroup, + current->nsproxy->cgroup_ns); + return parent ? &parent->self : NULL; + } else /* BPF_CGROUP_ITER_SELF_ONLY */ return NULL; } diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index c0377726031f..d60b5dfbbbc9 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -1417,11 +1417,11 @@ static inline struct cgroup *__cset_cgroup_from_root(struct css_set *cset, } /* - * look up cgroup associated with current task's cgroup namespace on the + * look up cgroup associated with given cgroup namespace on the * specified hierarchy */ -static struct cgroup * -current_cgns_cgroup_from_root(struct cgroup_root *root) +static struct cgroup *cgns_cgroup_from_root(struct cgroup_root *root, + struct cgroup_namespace *ns) { struct cgroup *res = NULL; struct css_set *cset; @@ -1430,7 +1430,7 @@ current_cgns_cgroup_from_root(struct cgroup_root *root) rcu_read_lock(); - cset = current->nsproxy->cgroup_ns->root_cset; + cset = ns->root_cset; res = __cset_cgroup_from_root(cset, root); rcu_read_unlock(); @@ -1852,15 +1852,15 @@ int cgroup_show_path(struct seq_file *sf, struct kernfs_node *kf_node, int len = 0; char *buf = NULL; struct cgroup_root *kf_cgroot = cgroup_root_from_kf(kf_root); - struct cgroup *ns_cgroup; + struct cgroup *root_cgroup; buf = kmalloc(PATH_MAX, GFP_KERNEL); if (!buf) return -ENOMEM; spin_lock_irq(&css_set_lock); - ns_cgroup = current_cgns_cgroup_from_root(kf_cgroot); - len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX); + root_cgroup = cgns_cgroup_from_root(kf_cgroot, current->nsproxy->cgroup_ns); + len = kernfs_path_from_node(kf_node, root_cgroup->kn, buf, PATH_MAX); spin_unlock_irq(&css_set_lock); if (len >= PATH_MAX) @@ -2330,6 +2330,18 @@ int cgroup_path_ns(struct cgroup *cgrp, char *buf, size_t buflen, } EXPORT_SYMBOL_GPL(cgroup_path_ns); +struct cgroup *cgroup_parent_ns(struct cgroup *cgrp, + struct cgroup_namespace *ns) +{ + struct cgroup *root_cgrp; + + spin_lock_irq(&css_set_lock); + root_cgrp = cgns_cgroup_from_root(cgrp->root, ns); + spin_unlock_irq(&css_set_lock); + + return cgrp == root_cgrp ? NULL : cgroup_parent(cgrp); +} + /** * task_cgroup_path - cgroup path of a task in the first cgroup hierarchy * @task: target task @@ -6031,7 +6043,8 @@ struct cgroup *cgroup_get_from_id(u64 id) goto out; spin_lock_irq(&css_set_lock); - root_cgrp = current_cgns_cgroup_from_root(&cgrp_dfl_root); + root_cgrp = cgns_cgroup_from_root(&cgrp_dfl_root, + current->nsproxy->cgroup_ns); spin_unlock_irq(&css_set_lock); if (!cgroup_is_descendant(cgrp, root_cgrp)) { cgroup_put(cgrp); @@ -6612,7 +6625,8 @@ struct cgroup *cgroup_get_from_path(const char *path) struct cgroup *root_cgrp; spin_lock_irq(&css_set_lock); - root_cgrp = current_cgns_cgroup_from_root(&cgrp_dfl_root); + root_cgrp = cgns_cgroup_from_root(&cgrp_dfl_root, + current->nsproxy->cgroup_ns); kn = kernfs_walk_and_get(root_cgrp->kn, path); spin_unlock_irq(&css_set_lock); if (!kn)