Hello Martin. 在 2023/9/13 03:57, Martin KaFai Lau 写道:
On 9/12/23 12:01 AM, Chuyi Zhou wrote:+__bpf_kfunc int bpf_iter_css_task_new(struct bpf_iter_css_task *it, + struct cgroup_subsys_state *css, unsigned int flags) +{ + struct bpf_iter_css_task_kern *kit = (void *)it; ++ BUILD_BUG_ON(sizeof(struct bpf_iter_css_task_kern) != sizeof(struct bpf_iter_css_task));+ BUILD_BUG_ON(__alignof__(struct bpf_iter_css_task_kern) != + __alignof__(struct bpf_iter_css_task)); + + switch (flags) { + case CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED: + case CSS_TASK_ITER_PROCS: + case 0: + break; + default: + return -EINVAL; + } + + kit->css_it = kzalloc(sizeof(struct css_task_iter), GFP_KERNEL); + if (!kit->css_it) + return -ENOMEM; + css_task_iter_start(css, flags, kit->css_it); + return 0; +} ++static bool check_css_task_iter_allowlist(struct bpf_verifier_env *env) +{ + enum bpf_prog_type prog_type = resolve_prog_type(env->prog); + + switch (prog_type) { + case BPF_PROG_TYPE_LSM:This will allow the non-sleepable lsm prog to call bpf_iter_css_task_new. The above kzalloc(GFP_KERNEL) in bpf_iter_css_task_new should trigger a lockdep error in the lsm selftest in patch 6.
Thanks for your test. I missed the dmesg error since I did not set CONFIG_LOCKDEP.
I think here we can use kzalloc(GFP_ATOMIC) to eliminate this error if we want to use this iter in non-sleepable lsm prog. I just tested, it works well.
+ return true; + case BPF_TRACE_ITER: + return env->prog->aux->sleepable; + default: + return false; + } +}
