From 659b3b2c488532140676affef036a1702fde6e32 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Fri, 2 May 2025 13:16:20 -0700 Subject: [PATCH 1/5] bpf: net_sched: Fix bpf qdisc init prologue when set as default qdisc Allow .init to proceed if qdisc_lookup() returns NULL as it only happens when called by qdisc_create_dflt() in mq/mqprio_init and the parent qdisc has not been added to qdisc_hash yet. In qdisc_create(), the caller, __tc_modify_qdisc(), would have made sure the parent qdisc already exist. In addition, call qdisc_watchdog_init() whether .init succeeds or not to prevent null-pointer dereference. In qdisc_create() and qdisc_create_dflt(), if .init fails, .destroy will be called. As a result, the destroy epilogue could call qdisc_watchdog_cancel() with an uninitialized timer, causing null-pointer deference in hrtimer_cancel(). Fixes: c8240344956e ("bpf: net_sched: Support implementation of Qdisc_ops in bpf") Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau --- net/sched/bpf_qdisc.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c index 9f32b305636f..a8efc3ff2b7e 100644 --- a/net/sched/bpf_qdisc.c +++ b/net/sched/bpf_qdisc.c @@ -234,18 +234,20 @@ __bpf_kfunc int bpf_qdisc_init_prologue(struct Qdisc *sch, struct net_device *dev = qdisc_dev(sch); struct Qdisc *p; - if (sch->parent != TC_H_ROOT) { - p = qdisc_lookup(dev, TC_H_MAJ(sch->parent)); - if (!p) - return -ENOENT; + qdisc_watchdog_init(&q->watchdog, sch); - if (!(p->flags & TCQ_F_MQROOT)) { + if (sch->parent != TC_H_ROOT) { + /* If qdisc_lookup() returns NULL, it means .init is called by + * qdisc_create_dflt() in mq/mqprio_init and the parent qdisc + * has not been added to qdisc_hash yet. + */ + p = qdisc_lookup(dev, TC_H_MAJ(sch->parent)); + if (p && !(p->flags & TCQ_F_MQROOT)) { NL_SET_ERR_MSG(extack, "BPF qdisc only supported on root or mq"); return -EINVAL; } } - qdisc_watchdog_init(&q->watchdog, sch); return 0; } From 6d080362c3218b92b98a17eb4132e0e5a7ed30d4 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Fri, 2 May 2025 13:16:21 -0700 Subject: [PATCH 2/5] selftests/bpf: Test setting and creating bpf qdisc as default qdisc First, test that bpf qdisc can be set as default qdisc. Then, attach an mq qdisc to see if bpf qdisc can be successfully created and grafted. The test is a sequential test as net.core.default_qdisc is global. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau --- .../selftests/bpf/prog_tests/bpf_qdisc.c | 60 +++++++++++++++++++ .../selftests/bpf/progs/bpf_qdisc_fifo.c | 3 + 2 files changed, 63 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c index c9a54177c84e..8952ddd2d5fc 100644 --- a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c +++ b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c @@ -159,6 +159,61 @@ static void test_qdisc_attach_to_non_root(void) bpf_qdisc_fifo__destroy(fifo_skel); } +static int get_default_qdisc(char *qdisc_name) +{ + FILE *f; + int num; + + f = fopen("/proc/sys/net/core/default_qdisc", "r"); + if (!f) + return -errno; + + num = fscanf(f, "%s", qdisc_name); + fclose(f); + + return num == 1 ? 0 : -EFAULT; +} + +static void test_default_qdisc_attach_to_mq(void) +{ + char default_qdisc[IFNAMSIZ] = {}; + struct bpf_qdisc_fifo *fifo_skel; + struct netns_obj *netns = NULL; + int err; + + fifo_skel = bpf_qdisc_fifo__open_and_load(); + if (!ASSERT_OK_PTR(fifo_skel, "bpf_qdisc_fifo__open_and_load")) + return; + + if (!ASSERT_OK(bpf_qdisc_fifo__attach(fifo_skel), "bpf_qdisc_fifo__attach")) + goto out; + + err = get_default_qdisc(default_qdisc); + if (!ASSERT_OK(err, "read sysctl net.core.default_qdisc")) + goto out; + + err = write_sysctl("/proc/sys/net/core/default_qdisc", "bpf_fifo"); + if (!ASSERT_OK(err, "write sysctl net.core.default_qdisc")) + goto out; + + netns = netns_new("bpf_qdisc_ns", true); + if (!ASSERT_OK_PTR(netns, "netns_new")) + goto out; + + SYS(out, "ip link add veth0 type veth peer veth1"); + SYS(out, "tc qdisc add dev veth0 root handle 1: mq"); + + ASSERT_EQ(fifo_skel->bss->init_called, true, "init_called"); + + SYS(out, "tc qdisc delete dev veth0 root mq"); +out: + netns_free(netns); + if (default_qdisc[0]) + write_sysctl("/proc/sys/net/core/default_qdisc", default_qdisc); + + bpf_qdisc_fifo__destroy(fifo_skel); +} + void test_bpf_qdisc(void) { struct netns_obj *netns; @@ -178,3 +233,8 @@ void test_bpf_qdisc(void) netns_free(netns); } + +void serial_test_bpf_qdisc_default(void) +{ + test_default_qdisc_attach_to_mq(); +} diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c index 0c7cfb82dae1..571fa7233ec0 100644 --- a/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c @@ -14,6 +14,8 @@ struct skb_node { private(A) struct bpf_spin_lock q_fifo_lock; private(A) struct bpf_list_head q_fifo __contains(skb_node, node); +bool init_called; + SEC("struct_ops/bpf_fifo_enqueue") int BPF_PROG(bpf_fifo_enqueue, struct sk_buff *skb, struct Qdisc *sch, struct bpf_sk_buff_ptr *to_free) @@ -77,6 +79,7 @@ int BPF_PROG(bpf_fifo_init, struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { sch->limit = 1000; + init_called = true; return 0; } From 64d6e3b9df1b12e35181e886d771d8920118e742 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Fri, 2 May 2025 13:16:22 -0700 Subject: [PATCH 3/5] bpf: net_sched: Make some Qdisc_ops ops mandatory The patch makes all currently supported Qdisc_ops (i.e., .enqueue, .dequeue, .init, .reset, and .destroy) mandatory. Make .init, .reset and .destroy mandatory as bpf qdisc relies on prologue and epilogue to check attach points and correctly initialize/cleanup resources. The prologue/epilogue will only be generated for an struct_ops operator only if users implement the operator. Make .enqueue and .dequeue mandatory as bpf qdisc infra does not provide a default data path. Fixes: c8240344956e ("bpf: net_sched: Support implementation of Qdisc_ops in bpf") Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau --- net/sched/bpf_qdisc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/sched/bpf_qdisc.c b/net/sched/bpf_qdisc.c index a8efc3ff2b7e..7ea8b54b2ab1 100644 --- a/net/sched/bpf_qdisc.c +++ b/net/sched/bpf_qdisc.c @@ -395,6 +395,17 @@ static void bpf_qdisc_unreg(void *kdata, struct bpf_link *link) return unregister_qdisc(kdata); } +static int bpf_qdisc_validate(void *kdata) +{ + struct Qdisc_ops *ops = (struct Qdisc_ops *)kdata; + + if (!ops->enqueue || !ops->dequeue || !ops->init || + !ops->reset || !ops->destroy) + return -EINVAL; + + return 0; +} + static int Qdisc_ops__enqueue(struct sk_buff *skb__ref, struct Qdisc *sch, struct sk_buff **to_free) { @@ -432,6 +443,7 @@ static struct bpf_struct_ops bpf_Qdisc_ops = { .verifier_ops = &bpf_qdisc_verifier_ops, .reg = bpf_qdisc_reg, .unreg = bpf_qdisc_unreg, + .validate = bpf_qdisc_validate, .init_member = bpf_qdisc_init_member, .init = bpf_qdisc_init, .name = "Qdisc_ops", From 6cda0e2c4760695123dad2af3328e1cfb4f3f540 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Fri, 2 May 2025 13:16:23 -0700 Subject: [PATCH 4/5] selftests/bpf: Test attaching a bpf qdisc with incomplete operators Implement .destroy in bpf_fq and bpf_fifo as it is now mandatory. Test attaching a bpf qdisc with a missing operator .init. This is not allowed as bpf qdisc qdisc_watchdog_cancel() could have been called with an uninitialized timer. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau --- .../selftests/bpf/prog_tests/bpf_qdisc.c | 19 +++++++++ .../bpf/progs/bpf_qdisc_fail__incompl_ops.c | 41 +++++++++++++++++++ .../selftests/bpf/progs/bpf_qdisc_fifo.c | 6 +++ .../selftests/bpf/progs/bpf_qdisc_fq.c | 6 +++ 4 files changed, 72 insertions(+) create mode 100644 tools/testing/selftests/bpf/progs/bpf_qdisc_fail__incompl_ops.c diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c index 8952ddd2d5fc..4b7aadb8ffe6 100644 --- a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c +++ b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c @@ -7,6 +7,7 @@ #include "network_helpers.h" #include "bpf_qdisc_fifo.skel.h" #include "bpf_qdisc_fq.skel.h" +#include "bpf_qdisc_fail__incompl_ops.skel.h" #define LO_IFINDEX 1 @@ -159,6 +160,22 @@ static void test_qdisc_attach_to_non_root(void) bpf_qdisc_fifo__destroy(fifo_skel); } +static void test_incompl_ops(void) +{ + struct bpf_qdisc_fail__incompl_ops *skel; + struct bpf_link *link; + + skel = bpf_qdisc_fail__incompl_ops__open_and_load(); + if (!ASSERT_OK_PTR(skel, "bpf_qdisc_fifo__open_and_load")) + return; + + link = bpf_map__attach_struct_ops(skel->maps.test); + if (!ASSERT_ERR_PTR(link, "bpf_map__attach_struct_ops")) + bpf_link__destroy(link); + + bpf_qdisc_fail__incompl_ops__destroy(skel); +} + static int get_default_qdisc(char *qdisc_name) { FILE *f; @@ -230,6 +247,8 @@ void test_bpf_qdisc(void) test_qdisc_attach_to_mq(); if (test__start_subtest("attach to non root")) test_qdisc_attach_to_non_root(); + if (test__start_subtest("incompl_ops")) + test_incompl_ops(); netns_free(netns); } diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__incompl_ops.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__incompl_ops.c new file mode 100644 index 000000000000..f188062ed730 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fail__incompl_ops.c @@ -0,0 +1,41 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include "bpf_experimental.h" +#include "bpf_qdisc_common.h" + +char _license[] SEC("license") = "GPL"; + +SEC("struct_ops") +int BPF_PROG(bpf_qdisc_test_enqueue, struct sk_buff *skb, struct Qdisc *sch, + struct bpf_sk_buff_ptr *to_free) +{ + bpf_qdisc_skb_drop(skb, to_free); + return NET_XMIT_DROP; +} + +SEC("struct_ops") +struct sk_buff *BPF_PROG(bpf_qdisc_test_dequeue, struct Qdisc *sch) +{ + return NULL; +} + +SEC("struct_ops") +void BPF_PROG(bpf_qdisc_test_reset, struct Qdisc *sch) +{ +} + +SEC("struct_ops") +void BPF_PROG(bpf_qdisc_test_destroy, struct Qdisc *sch) +{ +} + +SEC(".struct_ops") +struct Qdisc_ops test = { + .enqueue = (void *)bpf_qdisc_test_enqueue, + .dequeue = (void *)bpf_qdisc_test_dequeue, + .reset = (void *)bpf_qdisc_test_reset, + .destroy = (void *)bpf_qdisc_test_destroy, + .id = "bpf_qdisc_test", +}; + diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c index 571fa7233ec0..1de2be3e370b 100644 --- a/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fifo.c @@ -109,12 +109,18 @@ void BPF_PROG(bpf_fifo_reset, struct Qdisc *sch) sch->q.qlen = 0; } +SEC("struct_ops") +void BPF_PROG(bpf_fifo_destroy, struct Qdisc *sch) +{ +} + SEC(".struct_ops") struct Qdisc_ops fifo = { .enqueue = (void *)bpf_fifo_enqueue, .dequeue = (void *)bpf_fifo_dequeue, .init = (void *)bpf_fifo_init, .reset = (void *)bpf_fifo_reset, + .destroy = (void *)bpf_fifo_destroy, .id = "bpf_fifo", }; diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_fq.c b/tools/testing/selftests/bpf/progs/bpf_qdisc_fq.c index 7c110a156224..1a3233a275c7 100644 --- a/tools/testing/selftests/bpf/progs/bpf_qdisc_fq.c +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_fq.c @@ -740,11 +740,17 @@ int BPF_PROG(bpf_fq_init, struct Qdisc *sch, struct nlattr *opt, return 0; } +SEC("struct_ops") +void BPF_PROG(bpf_fq_destroy, struct Qdisc *sch) +{ +} + SEC(".struct_ops") struct Qdisc_ops fq = { .enqueue = (void *)bpf_fq_enqueue, .dequeue = (void *)bpf_fq_dequeue, .reset = (void *)bpf_fq_reset, .init = (void *)bpf_fq_init, + .destroy = (void *)bpf_fq_destroy, .id = "bpf_fq", }; From 2f9838e257901dae120927362060b40eac435a23 Mon Sep 17 00:00:00 2001 From: Amery Hung Date: Fri, 2 May 2025 13:16:24 -0700 Subject: [PATCH 5/5] selftests/bpf: Cleanup bpf qdisc selftests Some cleanups: - Remove unnecessary kfuncs declaration - Use _ns in the test name to run tests in a separate net namespace - Call skeleton __attach() instead of bpf_map__attach_struct_ops() to simplify tests. Signed-off-by: Amery Hung Signed-off-by: Martin KaFai Lau --- .../selftests/bpf/prog_tests/bpf_qdisc.c | 50 ++++--------------- .../selftests/bpf/progs/bpf_qdisc_common.h | 6 --- 2 files changed, 11 insertions(+), 45 deletions(-) diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c index 4b7aadb8ffe6..730357cd0c9a 100644 --- a/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c +++ b/tools/testing/selftests/bpf/prog_tests/bpf_qdisc.c @@ -50,42 +50,32 @@ static void do_test(char *qdisc) static void test_fifo(void) { struct bpf_qdisc_fifo *fifo_skel; - struct bpf_link *link; fifo_skel = bpf_qdisc_fifo__open_and_load(); if (!ASSERT_OK_PTR(fifo_skel, "bpf_qdisc_fifo__open_and_load")) return; - link = bpf_map__attach_struct_ops(fifo_skel->maps.fifo); - if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops")) { - bpf_qdisc_fifo__destroy(fifo_skel); - return; - } + if (!ASSERT_OK(bpf_qdisc_fifo__attach(fifo_skel), "bpf_qdisc_fifo__attach")) + goto out; do_test("bpf_fifo"); - - bpf_link__destroy(link); +out: bpf_qdisc_fifo__destroy(fifo_skel); } static void test_fq(void) { struct bpf_qdisc_fq *fq_skel; - struct bpf_link *link; fq_skel = bpf_qdisc_fq__open_and_load(); if (!ASSERT_OK_PTR(fq_skel, "bpf_qdisc_fq__open_and_load")) return; - link = bpf_map__attach_struct_ops(fq_skel->maps.fq); - if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops")) { - bpf_qdisc_fq__destroy(fq_skel); - return; - } + if (!ASSERT_OK(bpf_qdisc_fq__attach(fq_skel), "bpf_qdisc_fq__attach")) + goto out; do_test("bpf_fq"); - - bpf_link__destroy(link); +out: bpf_qdisc_fq__destroy(fq_skel); } @@ -97,18 +87,14 @@ static void test_qdisc_attach_to_mq(void) .handle = 0x11 << 16, .qdisc = "bpf_fifo"); struct bpf_qdisc_fifo *fifo_skel; - struct bpf_link *link; int err; fifo_skel = bpf_qdisc_fifo__open_and_load(); if (!ASSERT_OK_PTR(fifo_skel, "bpf_qdisc_fifo__open_and_load")) return; - link = bpf_map__attach_struct_ops(fifo_skel->maps.fifo); - if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops")) { - bpf_qdisc_fifo__destroy(fifo_skel); - return; - } + if (!ASSERT_OK(bpf_qdisc_fifo__attach(fifo_skel), "bpf_qdisc_fifo__attach")) + goto out; SYS(out, "ip link add veth0 type veth peer veth1"); hook.ifindex = if_nametoindex("veth0"); @@ -121,7 +107,6 @@ static void test_qdisc_attach_to_mq(void) SYS(out, "tc qdisc delete dev veth0 root mq"); out: - bpf_link__destroy(link); bpf_qdisc_fifo__destroy(fifo_skel); } @@ -133,18 +118,14 @@ static void test_qdisc_attach_to_non_root(void) .handle = 0x11 << 16, .qdisc = "bpf_fifo"); struct bpf_qdisc_fifo *fifo_skel; - struct bpf_link *link; int err; fifo_skel = bpf_qdisc_fifo__open_and_load(); if (!ASSERT_OK_PTR(fifo_skel, "bpf_qdisc_fifo__open_and_load")) return; - link = bpf_map__attach_struct_ops(fifo_skel->maps.fifo); - if (!ASSERT_OK_PTR(link, "bpf_map__attach_struct_ops")) { - bpf_qdisc_fifo__destroy(fifo_skel); - return; - } + if (!ASSERT_OK(bpf_qdisc_fifo__attach(fifo_skel), "bpf_qdisc_fifo__attach")) + goto out; SYS(out, "tc qdisc add dev lo root handle 1: htb"); SYS(out_del_htb, "tc class add dev lo parent 1: classid 1:1 htb rate 75Kbit"); @@ -156,7 +137,6 @@ static void test_qdisc_attach_to_non_root(void) out_del_htb: SYS(out, "tc qdisc delete dev lo root htb"); out: - bpf_link__destroy(link); bpf_qdisc_fifo__destroy(fifo_skel); } @@ -231,14 +211,8 @@ static void test_default_qdisc_attach_to_mq(void) bpf_qdisc_fifo__destroy(fifo_skel); } -void test_bpf_qdisc(void) +void test_ns_bpf_qdisc(void) { - struct netns_obj *netns; - - netns = netns_new("bpf_qdisc_ns", true); - if (!ASSERT_OK_PTR(netns, "netns_new")) - return; - if (test__start_subtest("fifo")) test_fifo(); if (test__start_subtest("fq")) @@ -249,8 +223,6 @@ void test_bpf_qdisc(void) test_qdisc_attach_to_non_root(); if (test__start_subtest("incompl_ops")) test_incompl_ops(); - - netns_free(netns); } void serial_test_bpf_qdisc_default(void) diff --git a/tools/testing/selftests/bpf/progs/bpf_qdisc_common.h b/tools/testing/selftests/bpf/progs/bpf_qdisc_common.h index 7e7f2fe04f22..3754f581b328 100644 --- a/tools/testing/selftests/bpf/progs/bpf_qdisc_common.h +++ b/tools/testing/selftests/bpf/progs/bpf_qdisc_common.h @@ -14,12 +14,6 @@ struct bpf_sk_buff_ptr; -u32 bpf_skb_get_hash(struct sk_buff *p) __ksym; -void bpf_kfree_skb(struct sk_buff *p) __ksym; -void bpf_qdisc_skb_drop(struct sk_buff *p, struct bpf_sk_buff_ptr *to_free) __ksym; -void bpf_qdisc_watchdog_schedule(struct Qdisc *sch, u64 expire, u64 delta_ns) __ksym; -void bpf_qdisc_bstats_update(struct Qdisc *sch, const struct sk_buff *skb) __ksym; - static struct qdisc_skb_cb *qdisc_skb_cb(const struct sk_buff *skb) { return (struct qdisc_skb_cb *)skb->cb;