Commit b44123b4 authored by YiFei Zhu's avatar YiFei Zhu Committed by Alexei Starovoitov
Browse files

bpf: Add cgroup helpers bpf_{get,set}_retval to get/set syscall return value 



The helpers continue to use int for retval because all the hooks
are int-returning rather than long-returning. The return value of
bpf_set_retval is int for future-proofing, in case in the future
there may be errors trying to set the retval.

After the previous patch, if a program rejects a syscall by
returning 0, an -EPERM will be generated no matter if the retval
is already set to -err. This patch change it being forced only if
retval is not -err. This is because we want to support, for
example, invoking bpf_set_retval(-EINVAL) and return 0, and have
the syscall return value be -EINVAL not -EPERM.

For BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY, the prior behavior is
that, if the return value is NET_XMIT_DROP, the packet is silently
dropped. We preserve this behavior for backward compatibility
reasons, so even if an errno is set, the errno does not return to
caller. However, setting a non-err to retval cannot propagate so
this is not allowed and we return a -EFAULT in that case.

Signed-off-by: default avatarYiFei Zhu <zhuyifei@google.com>
Reviewed-by: default avatarStanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/b4013fd5d16bed0b01977c1fafdeae12e1de61fb.1639619851.git.zhuyifei@google.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent c4dcfdd4

include/linux/bpf.h

+6 −4
Original line number Diff line number Diff line
@@ -1299,7 +1299,7 @@ BPF_PROG_RUN_ARRAY_CG_FLAGS(const struct bpf_prog_array __rcu *array_rcu, 
	while ((prog = READ_ONCE(item->prog))) {

		run_ctx.prog_item = item;

		func_ret = run_prog(prog, ctx);

		if (!(func_ret & 1))

		if (!(func_ret & 1) && !IS_ERR_VALUE((long)run_ctx.retval))

			run_ctx.retval = -EPERM;

		*(ret_flags) |= (func_ret >> 1);

		item++;
@@ -1329,7 +1329,7 @@ BPF_PROG_RUN_ARRAY_CG(const struct bpf_prog_array __rcu *array_rcu, 
	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);

	while ((prog = READ_ONCE(item->prog))) {

		run_ctx.prog_item = item;

		if (!run_prog(prog, ctx))

		if (!run_prog(prog, ctx) && !IS_ERR_VALUE((long)run_ctx.retval))

			run_ctx.retval = -EPERM;

		item++;

	}
@@ -1389,7 +1389,7 @@ BPF_PROG_RUN_ARRAY(const struct bpf_prog_array __rcu *array_rcu, 
 *   0: NET_XMIT_SUCCESS  skb should be transmitted

 *   1: NET_XMIT_DROP     skb should be dropped and cn

 *   2: NET_XMIT_CN       skb should be transmitted and cn

 *   3: -EPERM            skb should be dropped

 *   3: -err              skb should be dropped

 */

#define BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY(array, ctx, func)		\

	({						\
@@ -1398,10 +1398,12 @@ BPF_PROG_RUN_ARRAY(const struct bpf_prog_array __rcu *array_rcu, 
		u32 _ret;				\

		_ret = BPF_PROG_RUN_ARRAY_CG_FLAGS(array, ctx, func, 0, &_flags); \

		_cn = _flags & BPF_RET_SET_CN;		\

		if (_ret && !IS_ERR_VALUE((long)_ret))	\

			_ret = -EFAULT;			\

		if (!_ret)				\

			_ret = (_cn ? NET_XMIT_CN : NET_XMIT_SUCCESS);	\

		else					\

			_ret = (_cn ? NET_XMIT_DROP : -EPERM);		\

			_ret = (_cn ? NET_XMIT_DROP : _ret);		\

		_ret;					\

	})

include/uapi/linux/bpf.h

+18 −0
Original line number Diff line number Diff line
@@ -5033,6 +5033,22 @@ union bpf_attr { 
 *

 *	Return

 *		The number of arguments of the traced function.

 *

 * int bpf_get_retval(void)

 *	Description

 *		Get the syscall's return value that will be returned to userspace.

 *

 *		This helper is currently supported by cgroup programs only.

 *	Return

 *		The syscall's return value.

 *

 * int bpf_set_retval(int retval)

 *	Description

 *		Set the syscall's return value that will be returned to userspace.

 *

 *		This helper is currently supported by cgroup programs only.

 *	Return

 *		0 on success, or a negative error in case of failure.

 */

#define __BPF_FUNC_MAPPER(FN)		\

	FN(unspec),			\
@@ -5221,6 +5237,8 @@ union bpf_attr { 
	FN(get_func_arg),		\

	FN(get_func_ret),		\

	FN(get_func_arg_cnt),		\

	FN(get_retval),			\

	FN(set_retval),			\

	/* */



/* integer value in 'imm' field of BPF_CALL instruction selects which helper

kernel/bpf/cgroup.c

+37 −1
Original line number Diff line number Diff line
@@ -1044,7 +1044,7 @@ int cgroup_bpf_prog_query(const union bpf_attr *attr, 
 *   NET_XMIT_DROP       (1)	- drop packet and notify TCP to call cwr

 *   NET_XMIT_CN         (2)	- continue with packet output and notify TCP

 *				  to call cwr

 *   -EPERM			- drop packet

 *   -err			- drop packet

 *

 * For ingress packets, this function will return -EPERM if any

 * attached program was found and if it returned != 1 during execution.
@@ -1080,6 +1080,8 @@ int __cgroup_bpf_run_filter_skb(struct sock *sk, 
	} else {

		ret = BPF_PROG_RUN_ARRAY_CG(cgrp->bpf.effective[atype], skb,

					    __bpf_prog_run_save_cb, 0);

		if (ret && !IS_ERR_VALUE((long)ret))

			ret = -EFAULT;

	}

	bpf_restore_data_end(skb, saved_data_end);

	__skb_pull(skb, offset);
@@ -1205,6 +1207,36 @@ int __cgroup_bpf_check_dev_permission(short dev_type, u32 major, u32 minor, 
	return ret;

}



BPF_CALL_0(bpf_get_retval)

{

	struct bpf_cg_run_ctx *ctx =

		container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);



	return ctx->retval;

}



static const struct bpf_func_proto bpf_get_retval_proto = {

	.func		= bpf_get_retval,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

};



BPF_CALL_1(bpf_set_retval, int, retval)

{

	struct bpf_cg_run_ctx *ctx =

		container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);



	ctx->retval = retval;

	return 0;

}



static const struct bpf_func_proto bpf_set_retval_proto = {

	.func		= bpf_set_retval,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_ANYTHING,

};



static const struct bpf_func_proto *

cgroup_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)

{
@@ -1217,6 +1249,10 @@ cgroup_base_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
		return &bpf_get_current_cgroup_id_proto;

	case BPF_FUNC_perf_event_output:

		return &bpf_event_output_data_proto;

	case BPF_FUNC_get_retval:

		return &bpf_get_retval_proto;

	case BPF_FUNC_set_retval:

		return &bpf_set_retval_proto;

	default:

		return bpf_base_func_proto(func_id);

	}

tools/include/uapi/linux/bpf.h

+18 −0
Original line number Diff line number Diff line
@@ -5033,6 +5033,22 @@ union bpf_attr { 
 *

 *	Return

 *		The number of arguments of the traced function.

 *

 * int bpf_get_retval(void)

 *	Description

 *		Get the syscall's return value that will be returned to userspace.

 *

 *		This helper is currently supported by cgroup programs only.

 *	Return

 *		The syscall's return value.

 *

 * int bpf_set_retval(int retval)

 *	Description

 *		Set the syscall's return value that will be returned to userspace.

 *

 *		This helper is currently supported by cgroup programs only.

 *	Return

 *		0 on success, or a negative error in case of failure.

 */

#define __BPF_FUNC_MAPPER(FN)		\

	FN(unspec),			\
@@ -5221,6 +5237,8 @@ union bpf_attr { 
	FN(get_func_arg),		\

	FN(get_func_ret),		\

	FN(get_func_arg_cnt),		\

	FN(get_retval),			\

	FN(set_retval),			\

	/* */



/* integer value in 'imm' field of BPF_CALL instruction selects which helper