kernel/bpf/bpf_inode_storage.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Copyright (c) 2019 Facebook
   4  * Copyright 2020 Google LLC.
   5  */
   6
   7 #include <linux/rculist.h>
   8 #include <linux/list.h>
   9 #include <linux/hash.h>
  10 #include <linux/types.h>
  11 #include <linux/spinlock.h>
  12 #include <linux/bpf.h>
  13 #include <linux/bpf_local_storage.h>
  14 #include <net/sock.h>
  15 #include <uapi/linux/sock_diag.h>
  16 #include <uapi/linux/btf.h>
  17 #include <linux/bpf_lsm.h>
  18 #include <linux/btf_ids.h>
  19 #include <linux/fdtable.h>
  20 #include <linux/rcupdate_trace.h>
  21
  22 DEFINE_BPF_STORAGE_CACHE(inode_cache);
  23
  24 static struct bpf_local_storage __rcu **
  25 inode_storage_ptr(void *owner)
  26 {
  27         struct inode *inode = owner;
  28         struct bpf_storage_blob *bsb;
  29
  30         bsb = bpf_inode(inode);
  31         if (!bsb)
  32                 return NULL;
  33         return &bsb->storage;
  34 }
  35
  36 static struct bpf_local_storage_data *inode_storage_lookup(struct inode *inode,
  37                                                            struct bpf_map *map,
  38                                                            bool cacheit_lockit)
  39 {
  40         struct bpf_local_storage *inode_storage;
  41         struct bpf_local_storage_map *smap;
  42         struct bpf_storage_blob *bsb;
  43
  44         bsb = bpf_inode(inode);
  45         if (!bsb)
  46                 return NULL;
  47
  48         inode_storage =
  49                 rcu_dereference_check(bsb->storage, bpf_rcu_lock_held());
  50         if (!inode_storage)
  51                 return NULL;
  52
  53         smap = (struct bpf_local_storage_map *)map;
  54         return bpf_local_storage_lookup(inode_storage, smap, cacheit_lockit);
  55 }
  56
  57 void bpf_inode_storage_free(struct inode *inode)
  58 {
  59         struct bpf_local_storage *local_storage;
  60         struct bpf_storage_blob *bsb;
  61
  62         bsb = bpf_inode(inode);
  63         if (!bsb)
  64                 return;
  65
  66         rcu_read_lock();
  67
  68         local_storage = rcu_dereference(bsb->storage);
  69         if (!local_storage) {
  70                 rcu_read_unlock();
  71                 return;
  72         }
  73
  74         bpf_local_storage_destroy(local_storage);
  75         rcu_read_unlock();
  76 }
  77
  78 static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key)
  79 {
  80         struct bpf_local_storage_data *sdata;
  81         struct file *f;
  82         int fd;
  83
  84         fd = *(int *)key;
  85         f = fget_raw(fd);
  86         if (!f)
  87                 return ERR_PTR(-EBADF);
  88
  89         sdata = inode_storage_lookup(f->f_inode, map, true);
  90         fput(f);
  91         return sdata ? sdata->data : NULL;
  92 }
  93
  94 static long bpf_fd_inode_storage_update_elem(struct bpf_map *map, void *key,
  95                                              void *value, u64 map_flags)
  96 {
  97         struct bpf_local_storage_data *sdata;
  98         struct file *f;
  99         int fd;
 100
 101         fd = *(int *)key;
 102         f = fget_raw(fd);
 103         if (!f)
 104                 return -EBADF;
 105         if (!inode_storage_ptr(f->f_inode)) {
 106                 fput(f);
 107                 return -EBADF;
 108         }
 109
 110         sdata = bpf_local_storage_update(f->f_inode,
 111                                          (struct bpf_local_storage_map *)map,
 112                                          value, map_flags, GFP_ATOMIC);
 113         fput(f);
 114         return PTR_ERR_OR_ZERO(sdata);
 115 }
 116
 117 static int inode_storage_delete(struct inode *inode, struct bpf_map *map)
 118 {
 119         struct bpf_local_storage_data *sdata;
 120
 121         sdata = inode_storage_lookup(inode, map, false);
 122         if (!sdata)
 123                 return -ENOENT;
 124
 125         bpf_selem_unlink(SELEM(sdata), false);
 126
 127         return 0;
 128 }
 129
 130 static long bpf_fd_inode_storage_delete_elem(struct bpf_map *map, void *key)
 131 {
 132         struct file *f;
 133         int fd, err;
 134
 135         fd = *(int *)key;
 136         f = fget_raw(fd);
 137         if (!f)
 138                 return -EBADF;
 139
 140         err = inode_storage_delete(f->f_inode, map);
 141         fput(f);
 142         return err;
 143 }
 144
 145 /* *gfp_flags* is a hidden argument provided by the verifier */
 146 BPF_CALL_5(bpf_inode_storage_get, struct bpf_map *, map, struct inode *, inode,
 147            void *, value, u64, flags, gfp_t, gfp_flags)
 148 {
 149         struct bpf_local_storage_data *sdata;
 150
 151         WARN_ON_ONCE(!bpf_rcu_lock_held());
 152         if (flags & ~(BPF_LOCAL_STORAGE_GET_F_CREATE))
 153                 return (unsigned long)NULL;
 154
 155         /* explicitly check that the inode_storage_ptr is not
 156          * NULL as inode_storage_lookup returns NULL in this case and
 157          * bpf_local_storage_update expects the owner to have a
 158          * valid storage pointer.
 159          */
 160         if (!inode || !inode_storage_ptr(inode))
 161                 return (unsigned long)NULL;
 162
 163         sdata = inode_storage_lookup(inode, map, true);
 164         if (sdata)
 165                 return (unsigned long)sdata->data;
 166
 167         /* This helper must only called from where the inode is guaranteed
 168          * to have a refcount and cannot be freed.
 169          */
 170         if (flags & BPF_LOCAL_STORAGE_GET_F_CREATE) {
 171                 sdata = bpf_local_storage_update(
 172                         inode, (struct bpf_local_storage_map *)map, value,
 173                         BPF_NOEXIST, gfp_flags);
 174                 return IS_ERR(sdata) ? (unsigned long)NULL :
 175                                              (unsigned long)sdata->data;
 176         }
 177
 178         return (unsigned long)NULL;
 179 }
 180
 181 BPF_CALL_2(bpf_inode_storage_delete,
 182            struct bpf_map *, map, struct inode *, inode)
 183 {
 184         WARN_ON_ONCE(!bpf_rcu_lock_held());
 185         if (!inode)
 186                 return -EINVAL;
 187
 188         /* This helper must only called from where the inode is guaranteed
 189          * to have a refcount and cannot be freed.
 190          */
 191         return inode_storage_delete(inode, map);
 192 }
 193
 194 static int notsupp_get_next_key(struct bpf_map *map, void *key,
 195                                 void *next_key)
 196 {
 197         return -ENOTSUPP;
 198 }
 199
 200 static struct bpf_map *inode_storage_map_alloc(union bpf_attr *attr)
 201 {
 202         return bpf_local_storage_map_alloc(attr, &inode_cache, false);
 203 }
 204
 205 static void inode_storage_map_free(struct bpf_map *map)
 206 {
 207         bpf_local_storage_map_free(map, &inode_cache, NULL);
 208 }
 209
 210 const struct bpf_map_ops inode_storage_map_ops = {
 211         .map_meta_equal = bpf_map_meta_equal,
 212         .map_alloc_check = bpf_local_storage_map_alloc_check,
 213         .map_alloc = inode_storage_map_alloc,
 214         .map_free = inode_storage_map_free,
 215         .map_get_next_key = notsupp_get_next_key,
 216         .map_lookup_elem = bpf_fd_inode_storage_lookup_elem,
 217         .map_update_elem = bpf_fd_inode_storage_update_elem,
 218         .map_delete_elem = bpf_fd_inode_storage_delete_elem,
 219         .map_check_btf = bpf_local_storage_map_check_btf,
 220         .map_mem_usage = bpf_local_storage_map_mem_usage,
 221         .map_btf_id = &bpf_local_storage_map_btf_id[0],
 222         .map_owner_storage_ptr = inode_storage_ptr,
 223 };
 224
 225 BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)
 226
 227 const struct bpf_func_proto bpf_inode_storage_get_proto = {
 228         .func           = bpf_inode_storage_get,
 229         .gpl_only       = false,
 230         .ret_type       = RET_PTR_TO_MAP_VALUE_OR_NULL,
 231         .arg1_type      = ARG_CONST_MAP_PTR,
 232         .arg2_type      = ARG_PTR_TO_BTF_ID_OR_NULL,
 233         .arg2_btf_id    = &bpf_inode_storage_btf_ids[0],
 234         .arg3_type      = ARG_PTR_TO_MAP_VALUE_OR_NULL,
 235         .arg4_type      = ARG_ANYTHING,
 236 };
 237
 238 const struct bpf_func_proto bpf_inode_storage_delete_proto = {
 239         .func           = bpf_inode_storage_delete,
 240         .gpl_only       = false,
 241         .ret_type       = RET_INTEGER,
 242         .arg1_type      = ARG_CONST_MAP_PTR,
 243         .arg2_type      = ARG_PTR_TO_BTF_ID_OR_NULL,
 244         .arg2_btf_id    = &bpf_inode_storage_btf_ids[0],
 245 };