From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Colascione Subject: [PATCH v4] Wait for running BPF programs when updating map-in-map Date: Fri, 12 Oct 2018 03:54:27 -0700 Message-ID: <20181012105427.243779-1-dancol@google.com> References: <20180816040145.gqzqicab4s6kcbye@ast-mbp.dhcp.thefacebook.com> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: linux-kernel@vger.kernel.org, timmurray@google.com, netdev@vger.kernel.org, Alexei Starovoitov , Lorenzo Colitti , Chenbo Feng , Mathieu Desnoyers , Alexei Starovoitov , Daniel Borkmann , Daniel Colascione To: joelaf@google.com Return-path: In-Reply-To: <20180816040145.gqzqicab4s6kcbye@ast-mbp.dhcp.thefacebook.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org The map-in-map frequently serves as a mechanism for atomic snapshotting of state that a BPF program might record. The current implementation is dangerous to use in this way, however, since userspace has no way of knowing when all programs that might have retrieved the "old" value of the map may have completed. This change ensures that map update operations on map-in-map map types always wait for all references to the old map to drop before returning to userspace. Signed-off-by: Daniel Colascione --- kernel/bpf/syscall.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 8339d81cba1d..d7c16ae1e85a 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -741,6 +741,18 @@ static int map_lookup_elem(union bpf_attr *attr) return err; } +static void maybe_wait_bpf_programs(struct bpf_map *map) +{ + /* Wait for any running BPF programs to complete so that + * userspace, when we return to it, knows that all programs + * that could be running use the new map value. + */ + if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS || + map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS) { + synchronize_rcu(); + } +} + #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags static int map_update_elem(union bpf_attr *attr) @@ -831,6 +843,7 @@ static int map_update_elem(union bpf_attr *attr) } __this_cpu_dec(bpf_prog_active); preempt_enable(); + maybe_wait_bpf_programs(map); out: free_value: kfree(value); @@ -883,6 +896,7 @@ static int map_delete_elem(union bpf_attr *attr) rcu_read_unlock(); __this_cpu_dec(bpf_prog_active); preempt_enable(); + maybe_wait_bpf_programs(map); out: kfree(key); err_put: -- 2.19.0.605.g01d371f741-goog