projects/linux·blob master · refs

233 lines · 6.1 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Copyright (c) 2019 Facebook
4 * Copyright 2020 Google LLC.
5 */
6
7#include <linux/rculist.h>
8#include <linux/list.h>
9#include <linux/hash.h>
10#include <linux/types.h>
11#include <linux/spinlock.h>
12#include <linux/bpf.h>
13#include <linux/bpf_local_storage.h>
14#include <net/sock.h>
15#include <uapi/linux/sock_diag.h>
16#include <uapi/linux/btf.h>
17#include <linux/bpf_lsm.h>
18#include <linux/btf_ids.h>
19#include <linux/rcupdate_trace.h>
20
21DEFINE_BPF_STORAGE_CACHE(inode_cache);
22
23static struct bpf_local_storage __rcu **
24inode_storage_ptr(void *owner)
25{
26 struct inode *inode = owner;
27 struct bpf_storage_blob *bsb;
28
29 bsb = bpf_inode(inode);
30 if (!bsb)
31 return NULL;
32 return &bsb->storage;
33}
34
35static struct bpf_local_storage_data *inode_storage_lookup(struct inode *inode,
36 struct bpf_map *map,
37 bool cacheit_lockit)
38{
39 struct bpf_local_storage *inode_storage;
40 struct bpf_local_storage_map *smap;
41 struct bpf_storage_blob *bsb;
42
43 bsb = bpf_inode(inode);
44 if (!bsb)
45 return NULL;
46
47 inode_storage =
48 rcu_dereference_check(bsb->storage, bpf_rcu_lock_held());
49 if (!inode_storage)
50 return NULL;
51
52 smap = (struct bpf_local_storage_map *)map;
53 return bpf_local_storage_lookup(inode_storage, smap, cacheit_lockit);
54}
55
56void bpf_inode_storage_free(struct inode *inode)
57{
58 struct bpf_local_storage *local_storage;
59 struct bpf_storage_blob *bsb;
60
61 bsb = bpf_inode(inode);
62 if (!bsb)
63 return;
64
65 rcu_read_lock_dont_migrate();
66
67 local_storage = rcu_dereference(bsb->storage);
68 if (!local_storage)
69 goto out;
70
71 bpf_local_storage_destroy(local_storage);
72out:
73 rcu_read_unlock_migrate();
74}
75
76static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key)
77{
78 struct bpf_local_storage_data *sdata;
79 CLASS(fd_raw, f)(*(int *)key);
80
81 if (fd_empty(f))
82 return ERR_PTR(-EBADF);
83
84 sdata = inode_storage_lookup(file_inode(fd_file(f)), map, true);
85 return sdata ? sdata->data : NULL;
86}
87
88static long bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key,
89 void *value, u64 map_flags)
90{
91 struct bpf_local_storage_data *sdata;
92 CLASS(fd_raw, f)(*(int *)key);
93
94 if (fd_empty(f))
95 return -EBADF;
96 if (!inode_storage_ptr(file_inode(fd_file(f))))
97 return -EBADF;
98
99 sdata = bpf_local_storage_update(file_inode(fd_file(f)),
100 (struct bpf_local_storage_map *)map,
101 value, map_flags, false);
102 return PTR_ERR_OR_ZERO(sdata);
103}
104
105static int inode_storage_delete(struct inode *inode, struct bpf_map *map)
106{
107 struct bpf_local_storage_data *sdata;
108
109 sdata = inode_storage_lookup(inode, map, false);
110 if (!sdata)
111 return -ENOENT;
112
113 return bpf_selem_unlink(SELEM(sdata));
114}
115
116static long bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key)
117{
118 CLASS(fd_raw, f)(*(int *)key);
119
120 if (fd_empty(f))
121 return -EBADF;
122 return inode_storage_delete(file_inode(fd_file(f)), map);
123}
124
125BPF_CALL_4(bpf_inode_storage_get, struct bpf_map *, map, struct inode *, inode,
126 void *, value, u64, flags)
127{
128 struct bpf_local_storage_data *sdata;
129
130 WARN_ON_ONCE(!bpf_rcu_lock_held());
131 if (flags & ~(BPF_LOCAL_STORAGE_GET_F_CREATE))
132 return (unsigned long)NULL;
133
134 /* explicitly check that the inode_storage_ptr is not
135 * NULL as inode_storage_lookup returns NULL in this case and
136 * bpf_local_storage_update expects the owner to have a
137 * valid storage pointer.
138 */
139 if (!inode || !inode_storage_ptr(inode))
140 return (unsigned long)NULL;
141
142 sdata = inode_storage_lookup(inode, map, true);
143 if (sdata)
144 return (unsigned long)sdata->data;
145
146 /* This helper must only called from where the inode is guaranteed
147 * to have a refcount and cannot be freed.
148 */
149 if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
150 sdata = bpf_local_storage_update(
151 inode, (struct bpf_local_storage_map *)map, value,
152 BPF_NOEXIST, false);
153 return IS_ERR(sdata) ? (unsigned long)NULL :
154 (unsigned long)sdata->data;
155 }
156
157 return (unsigned long)NULL;
158}
159
160BPF_CALL_2(bpf_inode_storage_delete,
161 struct bpf_map *, map, struct inode *, inode)
162{
163 WARN_ON_ONCE(!bpf_rcu_lock_held());
164 if (!inode)
165 return -EINVAL;
166
167 /* This helper must only called from where the inode is guaranteed
168 * to have a refcount and cannot be freed.
169 */
170 return inode_storage_delete(inode, map);
171}
172
173static int notsupp_get_next_key(struct bpf_map *map, void *key,
174 void *next_key)
175{
176 return -ENOTSUPP;
177}
178
179static struct bpf_map *inode_storage_map_alloc(union bpf_attr *attr)
180{
181 /*
182 * Do not allow allocation of BPF_MAP_TYPE_INODE_STORAGE if the BPF LSM
183 * was not initialized by the LSM framework at boot. Without proper
184 * initialization, the BPF inode security blob offset remains unprepared,
185 * causing bpf_inode() to calculate an invalid memory offset and corrupt
186 * inode->i_security.
187 */
188 if (!bpf_lsm_initialized)
189 return ERR_PTR(-EOPNOTSUPP);
190 return bpf_local_storage_map_alloc(attr, &inode_cache);
191}
192
193static void inode_storage_map_free(struct bpf_map *map)
194{
195 bpf_local_storage_map_free(map, &inode_cache);
196}
197
198const struct bpf_map_ops inode_storage_map_ops = {
199 .map_meta_equal = bpf_map_meta_equal,
200 .map_alloc_check = bpf_local_storage_map_alloc_check,
201 .map_alloc = inode_storage_map_alloc,
202 .map_free = inode_storage_map_free,
203 .map_get_next_key = notsupp_get_next_key,
204 .map_lookup_elem = bpf_fd_inode_storage_lookup_elem,
205 .map_update_elem = bpf_fd_inode_storage_update_elem,
206 .map_delete_elem = bpf_fd_inode_storage_delete_elem,
207 .map_check_btf = bpf_local_storage_map_check_btf,
208 .map_mem_usage = bpf_local_storage_map_mem_usage,
209 .map_btf_id = &bpf_local_storage_map_btf_id[0],
210 .map_owner_storage_ptr = inode_storage_ptr,
211};
212
213BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)
214
215const struct bpf_func_proto bpf_inode_storage_get_proto = {
216 .func = bpf_inode_storage_get,
217 .gpl_only = false,
218 .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
219 .arg1_type = ARG_CONST_MAP_PTR,
220 .arg2_type = ARG_PTR_TO_BTF_ID_OR_NULL,
221 .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
222 .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
223 .arg4_type = ARG_ANYTHING,
224};
225
226const struct bpf_func_proto bpf_inode_storage_delete_proto = {
227 .func = bpf_inode_storage_delete,
228 .gpl_only = false,
229 .ret_type = RET_INTEGER,
230 .arg1_type = ARG_CONST_MAP_PTR,
231 .arg2_type = ARG_PTR_TO_BTF_ID_OR_NULL,
232 .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
233};