kernel/bpf/bpf_inode_storage.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (c) 2019 Facebook
   4  * Copyright 2020 Google LLC.
   5  */
   6
   7 #include <linux/rculist.h>
   8 #include <linux/list.h>
   9 #include <linux/hash.h>
  10 #include <linux/types.h>
  11 #include <linux/spinlock.h>
  12 #include <linux/bpf.h>
  13 #include <linux/bpf_local_storage.h>
  14 #include <net/sock.h>
  15 #include <uapi/linux/sock_diag.h>
  16 #include <uapi/linux/btf.h>
  17 #include <linux/bpf_lsm.h>
  18 #include <linux/btf_ids.h>
  19 #include <linux/fdtable.h>
  20 #include <linux/rcupdate_trace.h>
  21
  22 DEFINE_BPF_STORAGE_CACHE(inode_cache);
  23
  24 static struct bpf_local_storage __rcu **
  25 inode_storage_ptr(void *owner)
  26 {
  27         struct inode *inode = owner;
  28         struct bpf_storage_blob *bsb;
  29
  30         bsb = bpf_inode(inode);
  31         if (!bsb)
  32                 return NULL;
  33         return &bsb->storage;
  34 }
  35
  36 static struct bpf_local_storage_data *inode_storage_lookup(struct inode *inode,
  37                                                            struct bpf_map *map,
  38                                                            bool cacheit_lockit)
  39 {
  40         struct bpf_local_storage *inode_storage;
  41         struct bpf_local_storage_map *smap;
  42         struct bpf_storage_blob *bsb;
  43
  44         bsb = bpf_inode(inode);
  45         if (!bsb)
  46                 return NULL;
  47
  48         inode_storage =
  49                 rcu_dereference_check(bsb->storage, bpf_rcu_lock_held());
  50         if (!inode_storage)
  51                 return NULL;
  52
  53         smap = (struct bpf_local_storage_map *)map;
  54         return bpf_local_storage_lookup(inode_storage, smap, cacheit_lockit);
  55 }
  56
  57 void bpf_inode_storage_free(struct inode *inode)
  58 {
  59         struct bpf_local_storage *local_storage;
  60         bool free_inode_storage = false;
  61         struct bpf_storage_blob *bsb;
  62
  63         bsb = bpf_inode(inode);
  64         if (!bsb)
  65                 return;
  66
  67         rcu_read_lock();
  68
  69         local_storage = rcu_dereference(bsb->storage);
  70         if (!local_storage) {
  71                 rcu_read_unlock();
  72                 return;
  73         }
  74
  75         raw_spin_lock_bh(&local_storage->lock);
  76         free_inode_storage = bpf_local_storage_unlink_nolock(local_storage);
  77         raw_spin_unlock_bh(&local_storage->lock);
  78         rcu_read_unlock();
  79
  80         if (free_inode_storage)
  81                 kfree_rcu(local_storage, rcu);
  82 }
  83
  84 static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key)
  85 {
  86         struct bpf_local_storage_data *sdata;
  87         struct fd f = fdget_raw(*(int *)key);
  88
  89         if (!f.file)
  90                 return ERR_PTR(-EBADF);
  91
  92         sdata = inode_storage_lookup(file_inode(f.file), map, true);
  93         fdput(f);
  94         return sdata ? sdata->data : NULL;
  95 }
  96
  97 static int bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key,
  98                                          void *value, u64 map_flags)
  99 {
 100         struct bpf_local_storage_data *sdata;
 101         struct fd f = fdget_raw(*(int *)key);
 102
 103         if (!f.file)
 104                 return -EBADF;
 105         if (!inode_storage_ptr(file_inode(f.file))) {
 106                 fdput(f);
 107                 return -EBADF;
 108         }
 109
 110         sdata = bpf_local_storage_update(file_inode(f.file),
 111                                          (struct bpf_local_storage_map *)map,
 112                                          value, map_flags, GFP_ATOMIC);
 113         fdput(f);
 114         return PTR_ERR_OR_ZERO(sdata);
 115 }
 116
 117 static int inode_storage_delete(struct inode *inode, struct bpf_map *map)
 118 {
 119         struct bpf_local_storage_data *sdata;
 120
 121         sdata = inode_storage_lookup(inode, map, false);
 122         if (!sdata)
 123                 return -ENOENT;
 124
 125         bpf_selem_unlink(SELEM(sdata), true);
 126
 127         return 0;
 128 }
 129
 130 static int bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key)
 131 {
 132         struct fd f = fdget_raw(*(int *)key);
 133         int err;
 134
 135         if (!f.file)
 136                 return -EBADF;
 137
 138         err = inode_storage_delete(file_inode(f.file), map);
 139         fdput(f);
 140         return err;
 141 }
 142
 143 /* *gfp_flags* is a hidden argument provided by the verifier */
 144 BPF_CALL_5(bpf_inode_storage_get, struct bpf_map *, map, struct inode *, inode,
 145            void *, value, u64, flags, gfp_t, gfp_flags)
 146 {
 147         struct bpf_local_storage_data *sdata;
 148
 149         WARN_ON_ONCE(!bpf_rcu_lock_held());
 150         if (flags & ~(BPF_LOCAL_STORAGE_GET_F_CREATE))
 151                 return (unsigned long)NULL;
 152
 153         /* explicitly check that the inode_storage_ptr is not
 154          * NULL as inode_storage_lookup returns NULL in this case and
 155          * bpf_local_storage_update expects the owner to have a
 156          * valid storage pointer.
 157          */
 158         if (!inode || !inode_storage_ptr(inode))
 159                 return (unsigned long)NULL;
 160
 161         sdata = inode_storage_lookup(inode, map, true);
 162         if (sdata)
 163                 return (unsigned long)sdata->data;
 164
 165         /* This helper must only called from where the inode is guaranteed
 166          * to have a refcount and cannot be freed.
 167          */
 168         if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
 169                 sdata = bpf_local_storage_update(
 170                         inode, (struct bpf_local_storage_map *)map, value,
 171                         BPF_NOEXIST, gfp_flags);
 172                 return IS_ERR(sdata) ? (unsigned long)NULL :
 173                                              (unsigned long)sdata->data;
 174         }
 175
 176         return (unsigned long)NULL;
 177 }
 178
 179 BPF_CALL_2(bpf_inode_storage_delete,
 180            struct bpf_map *, map, struct inode *, inode)
 181 {
 182         WARN_ON_ONCE(!bpf_rcu_lock_held());
 183         if (!inode)
 184                 return -EINVAL;
 185
 186         /* This helper must only called from where the inode is guaranteed
 187          * to have a refcount and cannot be freed.
 188          */
 189         return inode_storage_delete(inode, map);
 190 }
 191
 192 static int notsupp_get_next_key(struct bpf_map *map, void *key,
 193                                 void *next_key)
 194 {
 195         return -ENOTSUPP;
 196 }
 197
 198 static struct bpf_map *inode_storage_map_alloc(union bpf_attr *attr)
 199 {
 200         return bpf_local_storage_map_alloc(attr, &inode_cache);
 201 }
 202
 203 static void inode_storage_map_free(struct bpf_map *map)
 204 {
 205         bpf_local_storage_map_free(map, &inode_cache, NULL);
 206 }
 207
 208 const struct bpf_map_ops inode_storage_map_ops = {
 209         .map_meta_equal = bpf_map_meta_equal,
 210         .map_alloc_check = bpf_local_storage_map_alloc_check,
 211         .map_alloc = inode_storage_map_alloc,
 212         .map_free = inode_storage_map_free,
 213         .map_get_next_key = notsupp_get_next_key,
 214         .map_lookup_elem = bpf_fd_inode_storage_lookup_elem,
 215         .map_update_elem = bpf_fd_inode_storage_update_elem,
 216         .map_delete_elem = bpf_fd_inode_storage_delete_elem,
 217         .map_check_btf = bpf_local_storage_map_check_btf,
 218         .map_btf_id = &bpf_local_storage_map_btf_id[0],
 219         .map_owner_storage_ptr = inode_storage_ptr,
 220 };
 221
 222 BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)
 223
 224 const struct bpf_func_proto bpf_inode_storage_get_proto = {
 225         .func           = bpf_inode_storage_get,
 226         .gpl_only       = false,
 227         .ret_type       = RET_PTR_TO_MAP_VALUE_OR_NULL,
 228         .arg1_type      = ARG_CONST_MAP_PTR,
 229         .arg2_type      = ARG_PTR_TO_BTF_ID,
 230         .arg2_btf_id    = &bpf_inode_storage_btf_ids[0],
 231         .arg3_type      = ARG_PTR_TO_MAP_VALUE_OR_NULL,
 232         .arg4_type      = ARG_ANYTHING,
 233 };
 234
 235 const struct bpf_func_proto bpf_inode_storage_delete_proto = {
 236         .func           = bpf_inode_storage_delete,
 237         .gpl_only       = false,
 238         .ret_type       = RET_INTEGER,
 239         .arg1_type      = ARG_CONST_MAP_PTR,
 240         .arg2_type      = ARG_PTR_TO_BTF_ID,
 241         .arg2_btf_id    = &bpf_inode_storage_btf_ids[0],
 242 };