[PATCH bpf v2 0/2] Fix elem_size not being set for inner maps

[PATCH bpf v2 0/2] Fix elem_size not being set for inner maps

[Rhys Rustad-Elliott]

Commit d937bc3449fa ("bpf: make uniform use of array->elem_size
everywhere in arraymap.c") changed array_map_gen_lookup to use
array->elem_size instead of round_up(map->value_size, 8) as the element
size when generating code to access a value in an array map.

array->elem_size, however, is not set by bpf_map_meta_alloc when
initializing an BPF_MAP_TYPE_ARRAY_OF_MAPS or BPF_MAP_TYPE_HASH_OF_MAPS.
This results in array_map_gen_lookup incorrectly outputting code that
always accesses index 0 in the array (as the index will be calculated
via a multiplication with the element size, which is incorrectly set to
0).

This patchset sets elem_size on the bpf_array object when allocating an
array or hash of maps to fix this and adds a selftest that accesses an
array map nested within a hash of maps at a nonzero index to prevent
regressions.

v1: https://lore.kernel.org/bpf/95b5da7c-ee52-3ecb-0a4e-f6a7a114f269@linux.dev/

Changelog:

v1 -> v2:

Address comments by Martin KaFai Lau:
- Directly use inner_array->elem_size instead of using round_up
- Move selftests to a new patch
- Use ASSERT_* macros instead of CHECK and remove duration
- Remove unnecessary usleep
- Shorten selftest name

Rhys Rustad-Elliott (2):
  bpf: Fix elem_size not being set for inner maps
  selftests/bpf: Add access_inner_map selftest

 kernel/bpf/map_in_map.c                       |  8 +++-
 .../bpf/prog_tests/inner_array_lookup.c       | 31 +++++++++++++
 .../bpf/progs/test_inner_array_lookup.c       | 45 +++++++++++++++++++
 3 files changed, 82 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_inner_array_lookup.c

-- 
2.40.1

[PATCH bpf v2 1/2] bpf: Fix elem_size not being set for inner maps

[Rhys Rustad-Elliott]

Commit d937bc3449fa ("bpf: make uniform use of array->elem_size
everywhere in arraymap.c") changed array_map_gen_lookup to use
array->elem_size instead of round_up(map->value_size, 8) as the element
size when generating code to access a value in an array map.

array->elem_size, however, is not set by bpf_map_meta_alloc when
initializing an BPF_MAP_TYPE_ARRAY_OF_MAPS or BPF_MAP_TYPE_HASH_OF_MAPS.
This results in array_map_gen_lookup incorrectly outputting code that
always accesses index 0 in the array (as the index will be calculated
via a multiplication with the element size, which is incorrectly set to
0).

Set elem_size on the bpf_array object when allocating an array or hash
of maps to fix this.

Fixes: d937bc3449fa ("bpf: make uniform use of array->elem_size everywhere in arraymap.c")
Signed-off-by: Rhys Rustad-Elliott <me@rhysre.net>
---
 kernel/bpf/map_in_map.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index 2c5c64c2a53b..cd5eafaba97e 100644
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c
@@ -69,9 +69,13 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
 	/* Misc members not needed in bpf_map_meta_equal() check. */
 	inner_map_meta->ops = inner_map->ops;
 	if (inner_map->ops == &array_map_ops) {
+		struct bpf_array *inner_array_meta =
+			container_of(inner_map_meta, struct bpf_array, map);
+		struct bpf_array *inner_array = container_of(inner_map, struct bpf_array, map);
+
+		inner_array_meta->index_mask = inner_array->index_mask;
+		inner_array_meta->elem_size = inner_array->elem_size;
 		inner_map_meta->bypass_spec_v1 = inner_map->bypass_spec_v1;
-		container_of(inner_map_meta, struct bpf_array, map)->index_mask =
-		     container_of(inner_map, struct bpf_array, map)->index_mask;
 	}
 
 	fdput(f);
-- 
2.40.1

[PATCH bpf v2 2/2] selftests/bpf: Add access_inner_map selftest

[Rhys Rustad-Elliott]

Add a selftest that accesses a BPF_MAP_TYPE_ARRAY (at a nonzero index)
nested within a BPF_MAP_TYPE_HASH_OF_MAPS to flex a previously buggy
case.

Signed-off-by: Rhys Rustad-Elliott <me@rhysre.net>
---
 .../bpf/prog_tests/inner_array_lookup.c       | 31 +++++++++++++
 .../bpf/progs/test_inner_array_lookup.c       | 45 +++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_inner_array_lookup.c

diff --git a/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c b/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
new file mode 100644
index 000000000000..29d4d0067c60
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <test_progs.h>
+
+#include "test_inner_array_lookup.skel.h"
+
+void test_inner_array_lookup(void)
+{
+	int map1_fd, err;
+	int key = 3;
+	int val = 1;
+	struct test_inner_array_lookup *skel;
+
+	skel = test_inner_array_lookup__open_and_load();
+	if (!ASSERT_TRUE(skel != NULL, "open_load_skeleton"))
+		return;
+
+	err = test_inner_array_lookup__attach(skel);
+	if (!ASSERT_TRUE(err == 0, "skeleton_attach"))
+		goto cleanup;
+
+	map1_fd = bpf_map__fd(skel->maps.inner_map1);
+	bpf_map_update_elem(map1_fd, &key, &val, 0);
+
+	/* Probe should have set the element at index 3 to 2 */
+	bpf_map_lookup_elem(map1_fd, &key, &val);
+	ASSERT_TRUE(val == 2, "value_is_2");
+
+cleanup:
+	test_inner_array_lookup__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c b/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c
new file mode 100644
index 000000000000..c2c8f2fa451d
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c
@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+
+struct inner_map {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 5);
+	__type(key, int);
+	__type(value, int);
+} inner_map1 SEC(".maps");
+
+struct outer_map {
+	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
+	__uint(max_entries, 3);
+	__type(key, int);
+	__array(values, struct inner_map);
+} outer_map1 SEC(".maps") = {
+	.values = {
+		[2] = &inner_map1,
+	},
+};
+
+SEC("raw_tp/sys_enter")
+int handle__sys_enter(void *ctx)
+{
+	int outer_key = 2, inner_key = 3;
+	int *val;
+	void *map;
+
+	map = bpf_map_lookup_elem(&outer_map1, &outer_key);
+	if (!map)
+		return 1;
+
+	val = bpf_map_lookup_elem(map, &inner_key);
+	if (!val)
+		return 1;
+
+	if (*val == 1)
+		*val = 2;
+
+	return 0;
+}
+
+char _license[] SEC("license") = "GPL";
-- 
2.40.1

Re: [PATCH bpf v2 2/2] selftests/bpf: Add access_inner_map selftest

[Martin KaFai Lau]

On 6/2/23 12:02 PM, Rhys Rustad-Elliott wrote:
> Add a selftest that accesses a BPF_MAP_TYPE_ARRAY (at a nonzero index)
> nested within a BPF_MAP_TYPE_HASH_OF_MAPS to flex a previously buggy
> case.
> 
> Signed-off-by: Rhys Rustad-Elliott <me@rhysre.net>
> ---
>   .../bpf/prog_tests/inner_array_lookup.c       | 31 +++++++++++++
>   .../bpf/progs/test_inner_array_lookup.c       | 45 +++++++++++++++++++
>   2 files changed, 76 insertions(+)
>   create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
>   create mode 100644 tools/testing/selftests/bpf/progs/test_inner_array_lookup.c
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c b/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
> new file mode 100644
> index 000000000000..29d4d0067c60
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c
> @@ -0,0 +1,31 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +#include <test_progs.h>
> +
> +#include "test_inner_array_lookup.skel.h"
> +
> +void test_inner_array_lookup(void)
> +{
> +	int map1_fd, err;
> +	int key = 3;
> +	int val = 1;
> +	struct test_inner_array_lookup *skel;
> +
> +	skel = test_inner_array_lookup__open_and_load();
> +	if (!ASSERT_TRUE(skel != NULL, "open_load_skeleton"))

Changed to ASSERT_OK_PTR. Similar changes to the ASSERT_TRUE below.

> +		return;
> +
> +	err = test_inner_array_lookup__attach(skel);
> +	if (!ASSERT_TRUE(err == 0, "skeleton_attach"))
> +		goto cleanup;
> +
> +	map1_fd = bpf_map__fd(skel->maps.inner_map1);
> +	bpf_map_update_elem(map1_fd, &key, &val, 0);
> +
> +	/* Probe should have set the element at index 3 to 2 */
> +	bpf_map_lookup_elem(map1_fd, &key, &val);
> +	ASSERT_TRUE(val == 2, "value_is_2");
> +
> +cleanup:
> +	test_inner_array_lookup__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c b/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c
> new file mode 100644
> index 000000000000..c2c8f2fa451d
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_inner_array_lookup.c

Removed 'test_' from the filename, already mentioned in v1.

Applied. Thanks for the fix.