Merge branch 'sockmap-uapi-updates-and-fixes' (7a483899) · Commits · 戴 / test

include/linux/bpf.h

+8 −2

Original line number	Diff line number	Diff line
		@@ -39,8 +39,6 @@ struct bpf_map_ops {
		void (map_fd_put_ptr)(void ptr);
		u32 (map_gen_lookup)(struct bpf_map map, struct bpf_insn *insn_buf);
		u32 (map_fd_sys_lookup_elem)(void ptr);
		int (map_attach)(struct bpf_map map,
		struct bpf_prog p1, struct bpf_prog p2);
		};

		struct bpf_map {
		@@ -387,11 +385,19 @@ static inline void __dev_map_flush(struct bpf_map *map)

		#if defined(CONFIG_STREAM_PARSER) && defined(CONFIG_BPF_SYSCALL)
		struct sock __sock_map_lookup_elem(struct bpf_map map, u32 key);
		int sock_map_attach_prog(struct bpf_map map, struct bpf_prog prog, u32 type);
		#else
		static inline struct sock __sock_map_lookup_elem(struct bpf_map map, u32 key)
		{
		return NULL;
		}

		static inline int sock_map_attach_prog(struct bpf_map *map,
		struct bpf_prog *prog,
		u32 type)
		{
		return -EOPNOTSUPP;
		}
		#endif

		/* verifier prototypes for helper functions called from eBPF programs */

include/uapi/linux/bpf.h

+3 −9

Original line number	Diff line number	Diff line
		@@ -136,15 +136,13 @@ enum bpf_attach_type {
		BPF_CGROUP_INET_EGRESS,
		BPF_CGROUP_INET_SOCK_CREATE,
		BPF_CGROUP_SOCK_OPS,
		BPF_CGROUP_SMAP_INGRESS,
		BPF_SK_SKB_STREAM_PARSER,
		BPF_SK_SKB_STREAM_VERDICT,
		__MAX_BPF_ATTACH_TYPE
		};

		#define MAX_BPF_ATTACH_TYPE __MAX_BPF_ATTACH_TYPE

		/* If BPF_SOCKMAP_STRPARSER is used sockmap will use strparser on receive */
		#define BPF_SOCKMAP_STRPARSER (1U << 0)

		/* If BPF_F_ALLOW_OVERRIDE flag is used in BPF_PROG_ATTACH command
		* to the given target_fd cgroup the descendent cgroup will be able to
		* override effective bpf program that was inherited from this cgroup
		@@ -224,7 +222,6 @@ union bpf_attr {
		__u32 attach_bpf_fd; /* eBPF program to attach */
		__u32 attach_type;
		__u32 attach_flags;
		__u32 attach_bpf_fd2;
		};

		struct { /* anonymous struct used by BPF_PROG_TEST_RUN command */
		@@ -580,14 +577,11 @@ union bpf_attr {
		* @flags: reserved for future use
		* Return: SK_REDIRECT
		*
		* int bpf_sock_map_update(skops, map, key, flags, map_flags)
		* int bpf_sock_map_update(skops, map, key, flags)
		* @skops: pointer to bpf_sock_ops
		* @map: pointer to sockmap to update
		* @key: key to insert/update sock in map
		* @flags: same flags as map update elem
		* @map_flags: sock map specific flags
		* bit 1: Enable strparser
		* other bits: reserved
		*/
		#define __BPF_FUNC_MAPPER(FN) \
		FN(unspec), \

kernel/bpf/sockmap.c

+194 −118

Original line number	Diff line number	Diff line
		@@ -13,15 +13,16 @@
		/* A BPF sock_map is used to store sock objects. This is primarly used
		* for doing socket redirect with BPF helper routines.
		*
		* A sock map may have two BPF programs attached to it, a program used
		* to parse packets and a program to provide a verdict and redirect
		* decision on the packet. If no BPF parse program is provided it is
		* assumed that every skb is a "message" (skb->len). Otherwise the
		* parse program is attached to strparser and used to build messages
		* that may span multiple skbs. The verdict program will either select
		* a socket to send/receive the skb on or provide the drop code indicating
		* the skb should be dropped. More actions may be added later as needed.
		* The default program will drop packets.
		* A sock map may have BPF programs attached to it, currently a program
		* used to parse packets and a program to provide a verdict and redirect
		* decision on the packet are supported. Any programs attached to a sock
		* map are inherited by sock objects when they are added to the map. If
		* no BPF programs are attached the sock object may only be used for sock
		* redirect.
		*
		* A sock object may be in multiple maps, but can only inherit a single
		* parse or verdict program. If adding a sock object to a map would result
		* in having multiple parsing programs the update will return an EBUSY error.
		*
		* For reference this program is similar to devmap used in XDP context
		* reviewing these together may be useful. For an example please review
		@@ -44,15 +45,21 @@ struct bpf_stab {
		struct sock **sock_map;
		struct bpf_prog *bpf_parse;
		struct bpf_prog *bpf_verdict;
		refcount_t refcnt;
		};

		enum smap_psock_state {
		SMAP_TX_RUNNING,
		};

		struct smap_psock_map_entry {
		struct list_head list;
		struct sock **entry;
		};

		struct smap_psock {
		struct rcu_head rcu;
		/* refcnt is used inside sk_callback_lock */
		u32 refcnt;

		/* datapath variables */
		struct sk_buff_head rxqueue;
		@@ -66,10 +73,9 @@ struct smap_psock {
		struct strparser strp;
		struct bpf_prog *bpf_parse;
		struct bpf_prog *bpf_verdict;
		struct bpf_stab *stab;
		struct list_head maps;

		/* Back reference used when sock callback trigger sockmap operations */
		int key;
		struct sock *sock;
		unsigned long state;

		@@ -83,7 +89,7 @@ struct smap_psock {

		static inline struct smap_psock smap_psock_sk(const struct sock sk)
		{
		return (struct smap_psock *)rcu_dereference_sk_user_data(sk);
		return rcu_dereference_sk_user_data(sk);
		}

		static int smap_verdict_func(struct smap_psock psock, struct sk_buff skb)
		@@ -149,12 +155,14 @@ static void smap_report_sk_error(struct smap_psock *psock, int err)
		sk->sk_error_report(sk);
		}

		static void smap_release_sock(struct sock *sock);
		static void smap_release_sock(struct smap_psock psock, struct sock sock);

		/* Called with lock_sock(sk) held */
		static void smap_state_change(struct sock *sk)
		{
		struct smap_psock_map_entry e, tmp;
		struct smap_psock *psock;
		struct socket_wq *wq;
		struct sock *osk;

		rcu_read_lock();
		@@ -164,6 +172,7 @@ static void smap_state_change(struct sock *sk)
		* is established.
		*/
		switch (sk->sk_state) {
		case TCP_SYN_SENT:
		case TCP_SYN_RECV:
		case TCP_ESTABLISHED:
		break;
		@@ -184,9 +193,15 @@ static void smap_state_change(struct sock *sk)
		psock = smap_psock_sk(sk);
		if (unlikely(!psock))
		break;
		osk = cmpxchg(&psock->stab->sock_map[psock->key], sk, NULL);
		if (osk == sk)
		smap_release_sock(sk);
		write_lock_bh(&sk->sk_callback_lock);
		list_for_each_entry_safe(e, tmp, &psock->maps, list) {
		osk = cmpxchg(e->entry, sk, NULL);
		if (osk == sk) {
		list_del(&e->list);
		smap_release_sock(psock, sk);
		}
		}
		write_unlock_bh(&sk->sk_callback_lock);
		break;
		default:
		psock = smap_psock_sk(sk);
		@@ -195,6 +210,10 @@ static void smap_state_change(struct sock *sk)
		smap_report_sk_error(psock, EPIPE);
		break;
		}

		wq = rcu_dereference(sk->sk_wq);
		if (skwq_has_sleeper(wq))
		wake_up_interruptible_all(&wq->wait);
		rcu_read_unlock();
		}

		@@ -214,12 +233,15 @@ static void smap_data_ready(struct sock *sk)
		{
		struct smap_psock *psock;

		write_lock_bh(&sk->sk_callback_lock);
		rcu_read_lock();
		psock = smap_psock_sk(sk);
		if (likely(psock))
		if (likely(psock)) {
		write_lock_bh(&sk->sk_callback_lock);
		strp_data_ready(&psock->strp);
		write_unlock_bh(&sk->sk_callback_lock);
		}
		rcu_read_unlock();
		}

		static void smap_tx_work(struct work_struct *w)
		{
		@@ -289,9 +311,8 @@ static void smap_write_space(struct sock *sk)

		static void smap_stop_sock(struct smap_psock psock, struct sock sk)
		{
		write_lock_bh(&sk->sk_callback_lock);
		if (!psock->strp_enabled)
		goto out;
		return;
		sk->sk_data_ready = psock->save_data_ready;
		sk->sk_write_space = psock->save_write_space;
		sk->sk_state_change = psock->save_state_change;
		@@ -300,8 +321,6 @@ static void smap_stop_sock(struct smap_psock psock, struct sock sk)
		psock->save_state_change = NULL;
		strp_stop(&psock->strp);
		psock->strp_enabled = false;
		out:
		write_unlock_bh(&sk->sk_callback_lock);
		}

		static void smap_destroy_psock(struct rcu_head *rcu)
		@@ -318,9 +337,11 @@ static void smap_destroy_psock(struct rcu_head *rcu)
		schedule_work(&psock->gc_work);
		}

		static void smap_release_sock(struct sock *sock)
		static void smap_release_sock(struct smap_psock psock, struct sock sock)
		{
		struct smap_psock *psock = smap_psock_sk(sock);
		psock->refcnt--;
		if (psock->refcnt)
		return;

		smap_stop_sock(psock, sock);
		clear_bit(SMAP_TX_RUNNING, &psock->state);
		@@ -414,6 +435,7 @@ static void sock_map_remove_complete(struct bpf_stab *stab)

		static void smap_gc_work(struct work_struct *w)
		{
		struct smap_psock_map_entry e, tmp;
		struct smap_psock *psock;

		psock = container_of(w, struct smap_psock, gc_work);
		@@ -431,8 +453,10 @@ static void smap_gc_work(struct work_struct *w)
		if (psock->bpf_verdict)
		bpf_prog_put(psock->bpf_verdict);

		if (refcount_dec_and_test(&psock->stab->refcnt))
		sock_map_remove_complete(psock->stab);
		list_for_each_entry_safe(e, tmp, &psock->maps, list) {
		list_del(&e->list);
		kfree(e);
		}

		sock_put(psock->sock);
		kfree(psock);
		@@ -453,6 +477,8 @@ static struct smap_psock smap_init_psock(struct sock sock,
		skb_queue_head_init(&psock->rxqueue);
		INIT_WORK(&psock->tx_work, smap_tx_work);
		INIT_WORK(&psock->gc_work, smap_gc_work);
		INIT_LIST_HEAD(&psock->maps);
		psock->refcnt = 1;

		rcu_assign_sk_user_data(sock, psock);
		sock_hold(sock);
		@@ -503,13 +529,24 @@ static struct bpf_map sock_map_alloc(union bpf_attr attr)
		if (!stab->sock_map)
		goto free_stab;

		refcount_set(&stab->refcnt, 1);
		return &stab->map;
		free_stab:
		kfree(stab);
		return ERR_PTR(err);
		}

		static void smap_list_remove(struct smap_psock psock, struct sock *entry)
		{
		struct smap_psock_map_entry e, tmp;

		list_for_each_entry_safe(e, tmp, &psock->maps, list) {
		if (e->entry == entry) {
		list_del(&e->list);
		break;
		}
		}
		}

		static void sock_map_free(struct bpf_map *map)
		{
		struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
		@@ -526,13 +563,18 @@ static void sock_map_free(struct bpf_map *map)
		*/
		rcu_read_lock();
		for (i = 0; i < stab->map.max_entries; i++) {
		struct smap_psock *psock;
		struct sock *sock;

		sock = xchg(&stab->sock_map[i], NULL);
		if (!sock)
		continue;

		smap_release_sock(sock);
		write_lock_bh(&sock->sk_callback_lock);
		psock = smap_psock_sk(sock);
		smap_list_remove(psock, &stab->sock_map[i]);
		smap_release_sock(psock, sock);
		write_unlock_bh(&sock->sk_callback_lock);
		}
		rcu_read_unlock();

		@@ -541,7 +583,6 @@ static void sock_map_free(struct bpf_map *map)
		if (stab->bpf_parse)
		bpf_prog_put(stab->bpf_parse);

		if (refcount_dec_and_test(&stab->refcnt))
		sock_map_remove_complete(stab);
		}

		@@ -576,6 +617,7 @@ struct sock __sock_map_lookup_elem(struct bpf_map map, u32 key)
		static int sock_map_delete_elem(struct bpf_map map, void key)
		{
		struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
		struct smap_psock *psock;
		int k = (u32 )key;
		struct sock *sock;

		@@ -586,7 +628,17 @@ static int sock_map_delete_elem(struct bpf_map map, void key)
		if (!sock)
		return -EINVAL;

		smap_release_sock(sock);
		write_lock_bh(&sock->sk_callback_lock);
		psock = smap_psock_sk(sock);
		if (!psock)
		goto out;

		if (psock->bpf_parse)
		smap_stop_sock(psock, sock);
		smap_list_remove(psock, &stab->sock_map[k]);
		smap_release_sock(psock, sock);
		out:
		write_unlock_bh(&sock->sk_callback_lock);
		return 0;
		}

		@@ -601,29 +653,34 @@ static int sock_map_delete_elem(struct bpf_map map, void key)
		* and syncd so we are certain all references from the update/lookup/delete
		* operations as well as references in the data path are no longer in use.
		*
		* A psock object holds a refcnt on the sockmap it is attached to and this is
		* not decremented until after a RCU grace period and garbage collection occurs.
		* This ensures the map is not free'd until psocks linked to it are removed. The
		* map link is used when the independent sock events trigger map deletion.
		* Psocks may exist in multiple maps, but only a single set of parse/verdict
		* programs may be inherited from the maps it belongs to. A reference count
		* is kept with the total number of references to the psock from all maps. The
		* psock will not be released until this reaches zero. The psock and sock
		* user data data use the sk_callback_lock to protect critical data structures
		* from concurrent access. This allows us to avoid two updates from modifying
		* the user data in sock and the lock is required anyways for modifying
		* callbacks, we simply increase its scope slightly.
		*
		* Psocks may only participate in one sockmap at a time. Users that try to
		* join a single sock to multiple maps will get an error.
		*
		* Last, but not least, it is possible the socket is closed while running
		* an update on an existing psock. This will release the psock, but again
		* not until the update has completed due to rcu grace period rules.
		* Rules to follow,
		* - psock must always be read inside RCU critical section
		* - sk_user_data must only be modified inside sk_callback_lock and read
		* inside RCU critical section.
		* - psock->maps list must only be read & modified inside sk_callback_lock
		* - sock_map must use READ_ONCE and (cmp)xchg operations
		* - BPF verdict/parse programs must use READ_ONCE and xchg operations
		*/
		static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops,
		struct bpf_map *map,
		void *key, u64 flags, u64 map_flags)
		void *key, u64 flags)
		{
		struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
		struct smap_psock_map_entry *e = NULL;
		struct bpf_prog verdict, parse;
		struct smap_psock *psock = NULL;
		struct sock old_sock, sock;
		struct sock osock, sock;
		struct smap_psock *psock;
		u32 i = (u32 )key;
		bool update = false;
		int err = 0;
		int err;

		if (unlikely(flags > BPF_EXIST))
		return -EINVAL;
		@@ -631,35 +688,22 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops,
		if (unlikely(i >= stab->map.max_entries))
		return -E2BIG;

		if (unlikely(map_flags > BPF_SOCKMAP_STRPARSER))
		return -EINVAL;

		verdict = parse = NULL;
		sock = READ_ONCE(stab->sock_map[i]);

		if (flags == BPF_EXIST \|\| flags == BPF_ANY) {
		if (!sock && flags == BPF_EXIST) {
		if (flags == BPF_EXIST && !sock)
		return -ENOENT;
		} else if (sock && sock != skops->sk) {
		return -EINVAL;
		} else if (sock) {
		psock = smap_psock_sk(sock);
		if (unlikely(!psock))
		return -EBUSY;
		update = true;
		}
		} else if (sock && BPF_NOEXIST) {
		else if (flags == BPF_NOEXIST && sock)
		return -EEXIST;
		}

		/* reserve BPF programs early so can abort easily on failures */
		if (map_flags & BPF_SOCKMAP_STRPARSER) {
		sock = skops->sk;

		/* 1. If sock map has BPF programs those will be inherited by the
		* sock being added. If the sock is already attached to BPF programs
		* this results in an error.
		*/
		verdict = READ_ONCE(stab->bpf_verdict);
		parse = READ_ONCE(stab->bpf_parse);

		if (!verdict \|\| !parse)
		return -ENOENT;

		if (parse && verdict) {
		/* bpf prog refcnt may be zero if a concurrent attach operation
		* removes the program after the above READ_ONCE() but before
		* we increment the refcnt. If this is the case abort with an
		@@ -676,67 +720,102 @@ static int sock_map_ctx_update_elem(struct bpf_sock_ops_kern *skops,
		}
		}

		if (!psock) {
		sock = skops->sk;
		if (rcu_dereference_sk_user_data(sock))
		return -EEXIST;
		write_lock_bh(&sock->sk_callback_lock);
		psock = smap_psock_sk(sock);

		/* 2. Do not allow inheriting programs if psock exists and has
		* already inherited programs. This would create confusion on
		* which parser/verdict program is running. If no psock exists
		* create one. Inside sk_callback_lock to ensure concurrent create
		* doesn't update user data.
		*/
		if (psock) {
		if (READ_ONCE(psock->bpf_parse) && parse) {
		err = -EBUSY;
		goto out_progs;
		}
		psock->refcnt++;
		} else {
		psock = smap_init_psock(sock, stab);
		if (IS_ERR(psock)) {
		if (verdict)
		bpf_prog_put(verdict);
		if (parse)
		bpf_prog_put(parse);
		return PTR_ERR(psock);
		err = PTR_ERR(psock);
		goto out_progs;
		}
		psock->key = i;
		psock->stab = stab;
		refcount_inc(&stab->refcnt);

		set_bit(SMAP_TX_RUNNING, &psock->state);
		}

		if (map_flags & BPF_SOCKMAP_STRPARSER) {
		write_lock_bh(&sock->sk_callback_lock);
		if (psock->strp_enabled)
		goto start_done;
		e = kzalloc(sizeof(*e), GFP_ATOMIC \| __GFP_NOWARN);
		if (!e) {
		err = -ENOMEM;
		goto out_progs;
		}
		e->entry = &stab->sock_map[i];

		/* 3. At this point we have a reference to a valid psock that is
		* running. Attach any BPF programs needed.
		*/
		if (parse && verdict && !psock->strp_enabled) {
		err = smap_init_sock(psock, sock);
		if (err)
		goto out;
		goto out_free;
		smap_init_progs(psock, stab, verdict, parse);
		smap_start_sock(psock, sock);
		start_done:
		write_unlock_bh(&sock->sk_callback_lock);
		} else if (update) {
		smap_stop_sock(psock, sock);
		}

		if (!update) {
		old_sock = xchg(&stab->sock_map[i], skops->sk);
		if (old_sock)
		smap_release_sock(old_sock);
		}
		/* 4. Place psock in sockmap for use and stop any programs on
		* the old sock assuming its not the same sock we are replacing
		* it with. Because we can only have a single set of programs if
		* old_sock has a strp we can stop it.
		*/
		list_add_tail(&e->list, &psock->maps);
		write_unlock_bh(&sock->sk_callback_lock);

		osock = xchg(&stab->sock_map[i], sock);
		if (osock) {
		struct smap_psock *opsock = smap_psock_sk(osock);

		write_lock_bh(&osock->sk_callback_lock);
		if (osock != sock && parse)
		smap_stop_sock(opsock, osock);
		smap_list_remove(opsock, &stab->sock_map[i]);
		smap_release_sock(opsock, osock);
		write_unlock_bh(&osock->sk_callback_lock);
		}
		return 0;
		out:
		out_free:
		smap_release_sock(psock, sock);
		out_progs:
		if (verdict)
		bpf_prog_put(verdict);
		if (parse)
		bpf_prog_put(parse);
		write_unlock_bh(&sock->sk_callback_lock);
		if (!update)
		smap_release_sock(sock);
		kfree(e);
		return err;
		}

		static int sock_map_attach_prog(struct bpf_map *map,
		struct bpf_prog *parse,
		struct bpf_prog *verdict)
		int sock_map_attach_prog(struct bpf_map map, struct bpf_prog prog, u32 type)
		{
		struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
		struct bpf_prog _parse, _verdict;
		struct bpf_prog *orig;

		_parse = xchg(&stab->bpf_parse, parse);
		_verdict = xchg(&stab->bpf_verdict, verdict);
		if (unlikely(map->map_type != BPF_MAP_TYPE_SOCKMAP))
		return -EINVAL;

		switch (type) {
		case BPF_SK_SKB_STREAM_PARSER:
		orig = xchg(&stab->bpf_parse, prog);
		break;
		case BPF_SK_SKB_STREAM_VERDICT:
		orig = xchg(&stab->bpf_verdict, prog);
		break;
		default:
		return -EOPNOTSUPP;
		}

		if (_parse)
		bpf_prog_put(_parse);
		if (_verdict)
		bpf_prog_put(_verdict);
		if (orig)
		bpf_prog_put(orig);

		return 0;
		}
		@@ -764,8 +843,7 @@ static int sock_map_update_elem(struct bpf_map *map,
		return -EINVAL;
		}

		err = sock_map_ctx_update_elem(&skops, map, key,
		flags, BPF_SOCKMAP_STRPARSER);
		err = sock_map_ctx_update_elem(&skops, map, key, flags);
		fput(socket->file);
		return err;
		}
		@@ -777,14 +855,13 @@ const struct bpf_map_ops sock_map_ops = {
		.map_get_next_key = sock_map_get_next_key,
		.map_update_elem = sock_map_update_elem,
		.map_delete_elem = sock_map_delete_elem,
		.map_attach = sock_map_attach_prog,
		};

		BPF_CALL_5(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock,
		struct bpf_map , map, void , key, u64, flags, u64, map_flags)
		BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock,
		struct bpf_map , map, void , key, u64, flags)
		{
		WARN_ON_ONCE(!rcu_read_lock_held());
		return sock_map_ctx_update_elem(bpf_sock, map, key, flags, map_flags);
		return sock_map_ctx_update_elem(bpf_sock, map, key, flags);
		}

		const struct bpf_func_proto bpf_sock_map_update_proto = {
		@@ -796,5 +873,4 @@ const struct bpf_func_proto bpf_sock_map_update_proto = {
		.arg2_type = ARG_CONST_MAP_PTR,
		.arg3_type = ARG_PTR_TO_MAP_KEY,
		.arg4_type = ARG_ANYTHING,
		.arg5_type = ARG_ANYTHING,
		};

kernel/bpf/syscall.c

+11 −27

Original line number	Diff line number	Diff line
		@@ -1093,12 +1093,12 @@ static int bpf_obj_get(const union bpf_attr *attr)

		#ifdef CONFIG_CGROUP_BPF

		#define BPF_PROG_ATTACH_LAST_FIELD attach_bpf_fd2
		#define BPF_PROG_ATTACH_LAST_FIELD attach_flags

		static int sockmap_get_from_fd(const union bpf_attr *attr, int ptype)
		static int sockmap_get_from_fd(const union bpf_attr *attr)
		{
		struct bpf_prog prog1, prog2;
		int ufd = attr->target_fd;
		struct bpf_prog *prog;
		struct bpf_map *map;
		struct fd f;
		int err;
		@@ -1108,29 +1108,16 @@ static int sockmap_get_from_fd(const union bpf_attr *attr, int ptype)
		if (IS_ERR(map))
		return PTR_ERR(map);

		if (!map->ops->map_attach) {
		fdput(f);
		return -EOPNOTSUPP;
		}

		prog1 = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
		if (IS_ERR(prog1)) {
		prog = bpf_prog_get_type(attr->attach_bpf_fd, BPF_PROG_TYPE_SK_SKB);
		if (IS_ERR(prog)) {
		fdput(f);
		return PTR_ERR(prog1);
		}

		prog2 = bpf_prog_get_type(attr->attach_bpf_fd2, ptype);
		if (IS_ERR(prog2)) {
		fdput(f);
		bpf_prog_put(prog1);
		return PTR_ERR(prog2);
		return PTR_ERR(prog);
		}

		err = map->ops->map_attach(map, prog1, prog2);
		err = sock_map_attach_prog(map, prog, attr->attach_type);
		if (err) {
		fdput(f);
		bpf_prog_put(prog1);
		bpf_prog_put(prog2);
		bpf_prog_put(prog);
		return err;
		}

		@@ -1165,16 +1152,13 @@ static int bpf_prog_attach(const union bpf_attr *attr)
		case BPF_CGROUP_SOCK_OPS:
		ptype = BPF_PROG_TYPE_SOCK_OPS;
		break;
		case BPF_CGROUP_SMAP_INGRESS:
		ptype = BPF_PROG_TYPE_SK_SKB;
		break;
		case BPF_SK_SKB_STREAM_PARSER:
		case BPF_SK_SKB_STREAM_VERDICT:
		return sockmap_get_from_fd(attr);
		default:
		return -EINVAL;
		}

		if (attr->attach_type == BPF_CGROUP_SMAP_INGRESS)
		return sockmap_get_from_fd(attr, ptype);

		prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
		if (IS_ERR(prog))
		return PTR_ERR(prog);

net/Kconfig

+12 −0

Original line number	Diff line number	Diff line
		@@ -301,6 +301,18 @@ config BPF_JIT
		/proc/sys/net/core/bpf_jit_harden (optional)
		/proc/sys/net/core/bpf_jit_kallsyms (optional)

		config BPF_STREAM_PARSER
		bool "enable BPF STREAM_PARSER"
		depends on BPF_SYSCALL
		select STREAM_PARSER
		---help---
		Enabling this allows a stream parser to be used with
		BPF_MAP_TYPE_SOCKMAP.

		BPF_MAP_TYPE_SOCKMAP provides a map type to use with network sockets.
		It can be used to enforce socket policy, implement socket redirects,
		etc.

		config NET_FLOW_LIMIT
		bool
		depends on RPS

Admin message