SOCKMAP now supports storing references to listening sockets. Nothing keeps us from using it as an array of sockets to select from in SK_REUSEPORT programs. Whitelist the map type with the BPF helper for selecting socket. However, impose a restriction that the selected socket needs to be a listening TCP socket or a bound UDP socket (connected or not). The only other map type that works with the BPF reuseport helper, REUSEPORT_SOCKARRAY, has a corresponding check in its update operation handler. Signed-off-by: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> --- kernel/bpf/verifier.c | 6 ++++-- net/core/filter.c | 2 ++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a0482e1c4a77..111a1eb543ab 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3685,7 +3685,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, if (func_id != BPF_FUNC_sk_redirect_map && func_id != BPF_FUNC_sock_map_update && func_id != BPF_FUNC_map_delete_elem && - func_id != BPF_FUNC_msg_redirect_map) + func_id != BPF_FUNC_msg_redirect_map && + func_id != BPF_FUNC_sk_select_reuseport) goto error; break; case BPF_MAP_TYPE_SOCKHASH: @@ -3766,7 +3767,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, goto error; break; case BPF_FUNC_sk_select_reuseport: - if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY) + if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY && + map->map_type != BPF_MAP_TYPE_SOCKMAP) goto error; break; case BPF_FUNC_map_peek_elem: diff --git a/net/core/filter.c b/net/core/filter.c index 49ded4a7588a..e3fb77353248 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8723,6 +8723,8 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, selected_sk = map->ops->map_lookup_elem(map, key); if (!selected_sk) return -ENOENT; + if (!sock_flag(selected_sk, SOCK_RCU_FREE)) + return -EINVAL; reuse = rcu_dereference(selected_sk->sk_reuseport_cb); if (!reuse) -- 2.20.1
