bpf: Add fd_array_cnt attribute for prog_load

The fd_array attribute of the BPF_PROG_LOAD syscall may contain a set
of file descriptors: maps or btfs. This field was introduced as a
sparse array. Introduce a new attribute, fd_array_cnt, which, if
present, indicates that the fd_array is a continuous array of the
corresponding length.

If fd_array_cnt is non-zero, then every map in the fd_array will be
bound to the program, as if it was used by the program. This
functionality is similar to the BPF_PROG_BIND_MAP syscall, but such
maps can be used by the verifier during the program load.

Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241213130934.1087929-5-aspsk@isovalent.com

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 4162afc6b5d0d630dea63a70a897bb8c7fd4518e..2acf9b33637174bd16b1d12ccc6410c5f55a7ea9 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1573,6 +1573,16 @@ union bpf_attr {
                 * If provided, prog_flags should have BPF_F_TOKEN_FD flag set.
                 */
                __s32           prog_token_fd;
+               /* The fd_array_cnt can be used to pass the length of the
+                * fd_array array. In this case all the [map] file descriptors
+                * passed in this array will be bound to the program, even if
+                * the maps are not referenced directly. The functionality is
+                * similar to the BPF_PROG_BIND_MAP syscall, but maps can be
+                * used by the verifier during the program load. If provided,
+                * then the fd_array[0,...,fd_array_cnt-1] is expected to be
+                * continuous.
+                */
+               __u32           fd_array_cnt;
        };
 
        struct { /* anonymous struct used by BPF_OBJ_* commands */

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 5684e8ce132d544834791279fad56fd78251058b..4e88797fdbebbce8cc958782f7de7e36b2754b5c 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2730,7 +2730,7 @@ static bool is_perfmon_prog_type(enum bpf_prog_type prog_type)
 }
 
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD prog_token_fd
+#define BPF_PROG_LOAD_LAST_FIELD fd_array_cnt
 
 static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size)
 {

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 296765ffbdc5d3705fa406d23839fe8bf9f4c25c..c0e772996c52c06c27e1fa01aeb799b60c89d911 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -19505,22 +19505,10 @@ static int check_map_prog_compatibility(struct bpf_verifier_env *env,
        return 0;
 }
 
-/* Add map behind fd to used maps list, if it's not already there, and return
- * its index.
- * Returns <0 on error, or >= 0 index, on success.
- */
-static int add_used_map_from_fd(struct bpf_verifier_env *env, int fd)
+static int __add_used_map(struct bpf_verifier_env *env, struct bpf_map *map)
 {
-       CLASS(fd, f)(fd);
-       struct bpf_map *map;
        int i, err;
 
-       map = __bpf_map_get(f);
-       if (IS_ERR(map)) {
-               verbose(env, "fd %d is not pointing to valid bpf_map\n", fd);
-               return PTR_ERR(map);
-       }
-
        /* check whether we recorded this map already */
        for (i = 0; i < env->used_map_cnt; i++)
                if (env->used_maps[i] == map)
@@ -19551,6 +19539,24 @@ static int add_used_map_from_fd(struct bpf_verifier_env *env, int fd)
        return env->used_map_cnt - 1;
 }
 
+/* Add map behind fd to used maps list, if it's not already there, and return
+ * its index.
+ * Returns <0 on error, or >= 0 index, on success.
+ */
+static int add_used_map(struct bpf_verifier_env *env, int fd)
+{
+       struct bpf_map *map;
+       CLASS(fd, f)(fd);
+
+       map = __bpf_map_get(f);
+       if (IS_ERR(map)) {
+               verbose(env, "fd %d is not pointing to valid bpf_map\n", fd);
+               return PTR_ERR(map);
+       }
+
+       return __add_used_map(env, map);
+}
+
 /* find and rewrite pseudo imm in ld_imm64 instructions:
  *
  * 1. if it accesses map FD, replace it with actual map pointer.
@@ -19642,7 +19648,7 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env)
                                break;
                        }
 
-                       map_idx = add_used_map_from_fd(env, fd);
+                       map_idx = add_used_map(env, fd);
                        if (map_idx < 0)
                                return map_idx;
                        map = env->used_maps[map_idx];
@@ -22850,6 +22856,73 @@ struct btf *bpf_get_btf_vmlinux(void)
        return btf_vmlinux;
 }
 
+/*
+ * The add_fd_from_fd_array() is executed only if fd_array_cnt is non-zero. In
+ * this case expect that every file descriptor in the array is either a map or
+ * a BTF. Everything else is considered to be trash.
+ */
+static int add_fd_from_fd_array(struct bpf_verifier_env *env, int fd)
+{
+       struct bpf_map *map;
+       struct btf *btf;
+       CLASS(fd, f)(fd);
+       int err;
+
+       map = __bpf_map_get(f);
+       if (!IS_ERR(map)) {
+               err = __add_used_map(env, map);
+               if (err < 0)
+                       return err;
+               return 0;
+       }
+
+       btf = __btf_get_by_fd(f);
+       if (!IS_ERR(btf)) {
+               err = __add_used_btf(env, btf);
+               if (err < 0)
+                       return err;
+               return 0;
+       }
+
+       verbose(env, "fd %d is not pointing to valid bpf_map or btf\n", fd);
+       return PTR_ERR(map);
+}
+
+static int process_fd_array(struct bpf_verifier_env *env, union bpf_attr *attr, bpfptr_t uattr)
+{
+       size_t size = sizeof(int);
+       int ret;
+       int fd;
+       u32 i;
+
+       env->fd_array = make_bpfptr(attr->fd_array, uattr.is_kernel);
+
+       /*
+        * The only difference between old (no fd_array_cnt is given) and new
+        * APIs is that in the latter case the fd_array is expected to be
+        * continuous and is scanned for map fds right away
+        */
+       if (!attr->fd_array_cnt)
+               return 0;
+
+       /* Check for integer overflow */
+       if (attr->fd_array_cnt >= (U32_MAX / size)) {
+               verbose(env, "fd_array_cnt is too big (%u)\n", attr->fd_array_cnt);
+               return -EINVAL;
+       }
+
+       for (i = 0; i < attr->fd_array_cnt; i++) {
+               if (copy_from_bpfptr_offset(&fd, env->fd_array, i * size, size))
+                       return -EFAULT;
+
+               ret = add_fd_from_fd_array(env, fd);
+               if (ret)
+                       return ret;
+       }
+
+       return 0;
+}
+
 int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u32 uattr_size)
 {
        u64 start_time = ktime_get_ns();
@@ -22881,7 +22954,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
                env->insn_aux_data[i].orig_idx = i;
        env->prog = *prog;
        env->ops = bpf_verifier_ops[env->prog->type];
-       env->fd_array = make_bpfptr(attr->fd_array, uattr.is_kernel);
 
        env->allow_ptr_leaks = bpf_allow_ptr_leaks(env->prog->aux->token);
        env->allow_uninit_stack = bpf_allow_uninit_stack(env->prog->aux->token);
@@ -22904,6 +22976,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
        if (ret)
                goto err_unlock;
 
+       ret = process_fd_array(env, attr, uattr);
+       if (ret)
+               goto skip_full_check;
+
        mark_verifier_state_clean(env);
 
        if (IS_ERR(btf_vmlinux)) {

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 4162afc6b5d0d630dea63a70a897bb8c7fd4518e..2acf9b33637174bd16b1d12ccc6410c5f55a7ea9 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1573,6 +1573,16 @@ union bpf_attr {
                 * If provided, prog_flags should have BPF_F_TOKEN_FD flag set.
                 */
                __s32           prog_token_fd;
+               /* The fd_array_cnt can be used to pass the length of the
+                * fd_array array. In this case all the [map] file descriptors
+                * passed in this array will be bound to the program, even if
+                * the maps are not referenced directly. The functionality is
+                * similar to the BPF_PROG_BIND_MAP syscall, but maps can be
+                * used by the verifier during the program load. If provided,
+                * then the fd_array[0,...,fd_array_cnt-1] is expected to be
+                * continuous.
+                */
+               __u32           fd_array_cnt;
        };
 
        struct { /* anonymous struct used by BPF_OBJ_* commands */