bpf: Introduce bpf_obj_drop

Introduce bpf_obj_drop, which is the kfunc used to free allocated
objects (allocated using bpf_obj_new). Pairing with bpf_obj_new, it
implicitly destructs the fields part of object automatically without
user intervention.

Just like the previous patch, btf_struct_meta that is needed to free up
the special fields is passed as a hidden argument to the kfunc.

For the user, a convenience macro hides over the kernel side kfunc which
is named bpf_obj_drop_impl.

Continuing the previous example:

void prog(void) {
	struct foo *f;

	f = bpf_obj_new(typeof(*f));
	if (!f)
		return;
	bpf_obj_drop(f);
}

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20221118015614.2013203-15-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index c4f1c22cc44c9b7d331a4a1dec9070052e3b30a1..71d803ca0c1d38a3f8af9c18ce0087bacf0f6dbf 100644 (file)
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1770,6 +1770,16 @@ void *bpf_obj_new_impl(u64 local_type_id__k, void *meta__ign)
        return p;
 }
 
+void bpf_obj_drop_impl(void *p__alloc, void *meta__ign)
+{
+       struct btf_struct_meta *meta = meta__ign;
+       void *p = p__alloc;
+
+       if (meta)
+               bpf_obj_free_fields(meta->record, p);
+       bpf_mem_free(&bpf_global_ma, p);
+}
+
 __diag_pop();
 
 BTF_SET8_START(generic_btf_ids)
@@ -1777,6 +1787,7 @@ BTF_SET8_START(generic_btf_ids)
 BTF_ID_FLAGS(func, crash_kexec, KF_DESTRUCTIVE)
 #endif
 BTF_ID_FLAGS(func, bpf_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
+BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)
 BTF_SET8_END(generic_btf_ids)
 
 static const struct btf_kfunc_id_set generic_kfunc_set = {

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 804f3bca6c0849983965da3a6ea4624af997a3da..1fbb0b51c429db96f3b16a70bbd6a00d6379be7d 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7879,6 +7879,10 @@ struct bpf_kfunc_call_arg_meta {
                u64 value;
                bool found;
        } arg_constant;
+       struct {
+               struct btf *btf;
+               u32 btf_id;
+       } arg_obj_drop;
 };
 
 static bool is_kfunc_acquire(struct bpf_kfunc_call_arg_meta *meta)
@@ -7957,6 +7961,11 @@ static bool is_kfunc_arg_ignore(const struct btf *btf, const struct btf_param *a
        return __kfunc_param_match_suffix(btf, arg, "__ign");
 }
 
+static bool is_kfunc_arg_alloc_obj(const struct btf *btf, const struct btf_param *arg)
+{
+       return __kfunc_param_match_suffix(btf, arg, "__alloc");
+}
+
 static bool is_kfunc_arg_scalar_with_name(const struct btf *btf,
                                          const struct btf_param *arg,
                                          const char *name)
@@ -8051,6 +8060,7 @@ static u32 *reg2btf_ids[__BPF_REG_TYPE_MAX] = {
 
 enum kfunc_ptr_arg_type {
        KF_ARG_PTR_TO_CTX,
+       KF_ARG_PTR_TO_ALLOC_BTF_ID,  /* Allocated object */
        KF_ARG_PTR_TO_KPTR,          /* PTR_TO_KPTR but type specific */
        KF_ARG_PTR_TO_DYNPTR,
        KF_ARG_PTR_TO_BTF_ID,        /* Also covers reg2btf_ids conversions */
@@ -8058,6 +8068,20 @@ enum kfunc_ptr_arg_type {
        KF_ARG_PTR_TO_MEM_SIZE,      /* Size derived from next argument, skip it */
 };
 
+enum special_kfunc_type {
+       KF_bpf_obj_new_impl,
+       KF_bpf_obj_drop_impl,
+};
+
+BTF_SET_START(special_kfunc_set)
+BTF_ID(func, bpf_obj_new_impl)
+BTF_ID(func, bpf_obj_drop_impl)
+BTF_SET_END(special_kfunc_set)
+
+BTF_ID_LIST(special_kfunc_list)
+BTF_ID(func, bpf_obj_new_impl)
+BTF_ID(func, bpf_obj_drop_impl)
+
 static enum kfunc_ptr_arg_type
 get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
                       struct bpf_kfunc_call_arg_meta *meta,
@@ -8078,6 +8102,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
        if (btf_get_prog_ctx_type(&env->log, meta->btf, t, resolve_prog_type(env->prog), argno))
                return KF_ARG_PTR_TO_CTX;
 
+       if (is_kfunc_arg_alloc_obj(meta->btf, &args[argno]))
+               return KF_ARG_PTR_TO_ALLOC_BTF_ID;
+
        if (is_kfunc_arg_kptr_get(meta, argno)) {
                if (!btf_type_is_ptr(ref_t)) {
                        verbose(env, "arg#0 BTF type must be a double pointer for kptr_get kfunc\n");
@@ -8294,6 +8321,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
                        return kf_arg_type;
 
                switch (kf_arg_type) {
+               case KF_ARG_PTR_TO_ALLOC_BTF_ID:
                case KF_ARG_PTR_TO_BTF_ID:
                        if (!is_kfunc_trusted_args(meta))
                                break;
@@ -8330,6 +8358,21 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
                                return -EINVAL;
                        }
                        break;
+               case KF_ARG_PTR_TO_ALLOC_BTF_ID:
+                       if (reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) {
+                               verbose(env, "arg#%d expected pointer to allocated object\n", i);
+                               return -EINVAL;
+                       }
+                       if (!reg->ref_obj_id) {
+                               verbose(env, "allocated object must be referenced\n");
+                               return -EINVAL;
+                       }
+                       if (meta->btf == btf_vmlinux &&
+                           meta->func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+                               meta->arg_obj_drop.btf = reg->btf;
+                               meta->arg_obj_drop.btf_id = reg->btf_id;
+                       }
+                       break;
                case KF_ARG_PTR_TO_KPTR:
                        if (reg->type != PTR_TO_MAP_VALUE) {
                                verbose(env, "arg#0 expected pointer to map value\n");
@@ -8400,17 +8443,6 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
        return 0;
 }
 
-enum special_kfunc_type {
-       KF_bpf_obj_new_impl,
-};
-
-BTF_SET_START(special_kfunc_set)
-BTF_ID(func, bpf_obj_new_impl)
-BTF_SET_END(special_kfunc_set)
-
-BTF_ID_LIST(special_kfunc_list)
-BTF_ID(func, bpf_obj_new_impl)
-
 static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                            int *insn_idx_p)
 {
@@ -8532,6 +8564,10 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                                env->insn_aux_data[insn_idx].obj_new_size = ret_t->size;
                                env->insn_aux_data[insn_idx].kptr_struct_meta =
                                        btf_find_struct_meta(ret_btf, ret_btf_id);
+                       } else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+                               env->insn_aux_data[insn_idx].kptr_struct_meta =
+                                       btf_find_struct_meta(meta.arg_obj_drop.btf,
+                                                            meta.arg_obj_drop.btf_id);
                        } else {
                                verbose(env, "kernel function %s unhandled dynamic return type\n",
                                        meta.func_name);
@@ -14768,6 +14804,14 @@ static int fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                insn_buf[2] = addr[1];
                insn_buf[3] = *insn;
                *cnt = 4;
+       } else if (desc->func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
+               struct btf_struct_meta *kptr_struct_meta = env->insn_aux_data[insn_idx].kptr_struct_meta;
+               struct bpf_insn addr[2] = { BPF_LD_IMM64(BPF_REG_2, (long)kptr_struct_meta) };
+
+               insn_buf[0] = addr[0];
+               insn_buf[1] = addr[1];
+               insn_buf[2] = *insn;
+               *cnt = 3;
        }
        return 0;
 }

diff --git a/tools/testing/selftests/bpf/bpf_experimental.h b/tools/testing/selftests/bpf/bpf_experimental.h
index aeb6a7fcb7c4fcdbf03bc9ce2dc1d50ce6ec7318..8473395a11af79f9f2d23a469f042ba0c1a4c23c 100644 (file)
--- a/tools/testing/selftests/bpf/bpf_experimental.h
+++ b/tools/testing/selftests/bpf/bpf_experimental.h
@@ -22,4 +22,17 @@ extern void *bpf_obj_new_impl(__u64 local_type_id, void *meta) __ksym;
 /* Convenience macro to wrap over bpf_obj_new_impl */
 #define bpf_obj_new(type) ((type *)bpf_obj_new_impl(bpf_core_type_id_local(type), NULL))
 
+/* Description
+ *     Free an allocated object. All fields of the object that require
+ *     destruction will be destructed before the storage is freed.
+ *
+ *     The 'meta' parameter is a hidden argument that is ignored.
+ * Returns
+ *     Void.
+ */
+extern void bpf_obj_drop_impl(void *kptr, void *meta) __ksym;
+
+/* Convenience macro to wrap over bpf_obj_drop_impl */
+#define bpf_obj_drop(kptr) bpf_obj_drop_impl(kptr, NULL)
+
 #endif