On Sat, Nov 23, 2019 at 12:07:48PM +0100, Jakub Sitnicki wrote: > SOCKMAP now supports storing references to listening sockets. Nothing keeps > us from using it as an array of sockets to select from in SK_REUSEPORT > programs. > > Whitelist the map type with the BPF helper for selecting socket. However, > impose a restriction that the selected socket needs to be a listening TCP > socket or a bound UDP socket (connected or not). > > The only other map type that works with the BPF reuseport helper, > REUSEPORT_SOCKARRAY, has a corresponding check in its update operation > handler. > > Signed-off-by: Jakub Sitnicki <jakub@xxxxxxxxxxxxxx> > --- > kernel/bpf/verifier.c | 6 ++++-- > net/core/filter.c | 2 ++ > 2 files changed, 6 insertions(+), 2 deletions(-) > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index a0482e1c4a77..111a1eb543ab 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -3685,7 +3685,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, > if (func_id != BPF_FUNC_sk_redirect_map && > func_id != BPF_FUNC_sock_map_update && > func_id != BPF_FUNC_map_delete_elem && > - func_id != BPF_FUNC_msg_redirect_map) > + func_id != BPF_FUNC_msg_redirect_map && > + func_id != BPF_FUNC_sk_select_reuseport) > goto error; > break; > case BPF_MAP_TYPE_SOCKHASH: > @@ -3766,7 +3767,8 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env, > goto error; > break; > case BPF_FUNC_sk_select_reuseport: > - if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY) > + if (map->map_type != BPF_MAP_TYPE_REUSEPORT_SOCKARRAY && > + map->map_type != BPF_MAP_TYPE_SOCKMAP) > goto error; > break; > case BPF_FUNC_map_peek_elem: > diff --git a/net/core/filter.c b/net/core/filter.c > index 49ded4a7588a..e3fb77353248 100644 > --- a/net/core/filter.c > +++ b/net/core/filter.c > @@ -8723,6 +8723,8 @@ BPF_CALL_4(sk_select_reuseport, struct sk_reuseport_kern *, reuse_kern, > selected_sk = map->ops->map_lookup_elem(map, key); > if (!selected_sk) > return -ENOENT; > + if (!sock_flag(selected_sk, SOCK_RCU_FREE)) > + return -EINVAL; hmm. I wonder whether this breaks existing users... Martin, what do you think? Could you also take a look at other patches too? In particular patch 7?
