Skip to content

bpf: verifier: refactor bpf_wq handling #6077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

bpf: verifier: refactor bpf_wq handling #6077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b21d3ae
bpf: verifier: refactor bpf_wq handling
mykyta5 Oct 1, 2025
8ed55de
bpf: extract internal structs helpers
mykyta5 Oct 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions include/linux/bpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -663,6 +663,10 @@ int map_check_no_btf(const struct bpf_map *map,
bool bpf_map_meta_equal(const struct bpf_map *meta0,
const struct bpf_map *meta1);

bool bpf_map_has_internal_structs(struct bpf_map *map);

void bpf_map_free_internal_structs(struct bpf_map *map, void *obj);

extern const struct bpf_map_ops bpf_map_offload_ops;

/* bpf_type_flag contains a set of flags that are applicable to the values of
Expand Down
17 changes: 6 additions & 11 deletions kernel/bpf/arraymap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -448,19 +448,14 @@ static void array_map_free_internal_structs(struct bpf_map *map)
struct bpf_array *array = container_of(map, struct bpf_array, map);
int i;

/* We don't reset or free fields other than timer and workqueue
/* We don't reset or free fields other than timer, workqueue and task_work
* on uref dropping to zero.
*/
if (btf_record_has_field(map->record, BPF_TIMER | BPF_WORKQUEUE | BPF_TASK_WORK)) {
for (i = 0; i < array->map.max_entries; i++) {
if (btf_record_has_field(map->record, BPF_TIMER))
bpf_obj_free_timer(map->record, array_map_elem_ptr(array, i));
if (btf_record_has_field(map->record, BPF_WORKQUEUE))
bpf_obj_free_workqueue(map->record, array_map_elem_ptr(array, i));
if (btf_record_has_field(map->record, BPF_TASK_WORK))
bpf_obj_free_task_work(map->record, array_map_elem_ptr(array, i));
}
}
if (!bpf_map_has_internal_structs(map))
return;

for (i = 0; i < array->map.max_entries; i++)
bpf_map_free_internal_structs(map, array_map_elem_ptr(array, i));
}

/* Called when map->refcnt goes to zero, either from workqueue or from syscall */
Expand Down
45 changes: 25 additions & 20 deletions kernel/bpf/hashtab.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,17 +215,19 @@ static bool htab_has_extra_elems(struct bpf_htab *htab)
return !htab_is_percpu(htab) && !htab_is_lru(htab) && !is_fd_htab(htab);
}

static void htab_free_internal_structs(struct bpf_htab *htab, struct htab_elem *elem)
bool bpf_map_has_internal_structs(struct bpf_map *map)
{
if (btf_record_has_field(htab->map.record, BPF_TIMER))
bpf_obj_free_timer(htab->map.record,
htab_elem_value(elem, htab->map.key_size));
if (btf_record_has_field(htab->map.record, BPF_WORKQUEUE))
bpf_obj_free_workqueue(htab->map.record,
htab_elem_value(elem, htab->map.key_size));
if (btf_record_has_field(htab->map.record, BPF_TASK_WORK))
bpf_obj_free_task_work(htab->map.record,
htab_elem_value(elem, htab->map.key_size));
return btf_record_has_field(map->record, BPF_TIMER | BPF_WORKQUEUE | BPF_TASK_WORK);
}

void bpf_map_free_internal_structs(struct bpf_map *map, void *obj)
{
if (btf_record_has_field(map->record, BPF_TIMER))
bpf_obj_free_timer(map->record, obj);
else if (btf_record_has_field(map->record, BPF_WORKQUEUE))
bpf_obj_free_workqueue(map->record, obj);
else if (btf_record_has_field(map->record, BPF_TASK_WORK))
bpf_obj_free_task_work(map->record, obj);
}

static void htab_free_prealloced_internal_structs(struct bpf_htab *htab)
Expand All @@ -240,7 +242,8 @@ static void htab_free_prealloced_internal_structs(struct bpf_htab *htab)
struct htab_elem *elem;

elem = get_htab_elem(htab, i);
htab_free_internal_structs(htab, elem);
bpf_map_free_internal_structs(&htab->map,
htab_elem_value(elem, htab->map.key_size));
cond_resched();
}
}
Expand Down Expand Up @@ -1509,8 +1512,9 @@ static void htab_free_malloced_internal_structs(struct bpf_htab *htab)
struct htab_elem *l;

hlist_nulls_for_each_entry(l, n, head, hash_node) {
/* We only free timer on uref dropping to zero */
htab_free_internal_structs(htab, l);
/* We only free timer, wq, task_work on uref dropping to zero */
bpf_map_free_internal_structs(&htab->map,
htab_elem_value(l, htab->map.key_size));
}
cond_resched_rcu();
}
Expand All @@ -1521,13 +1525,14 @@ static void htab_map_free_internal_structs(struct bpf_map *map)
{
struct bpf_htab *htab = container_of(map, struct bpf_htab, map);

/* We only free timer and workqueue on uref dropping to zero */
if (btf_record_has_field(htab->map.record, BPF_TIMER | BPF_WORKQUEUE | BPF_TASK_WORK)) {
if (!htab_is_prealloc(htab))
htab_free_malloced_internal_structs(htab);
else
htab_free_prealloced_internal_structs(htab);
}
/* We only free timer, workqueue, task_work on uref dropping to zero */
if (!bpf_map_has_internal_structs(map))
return;

if (htab_is_prealloc(htab))
htab_free_prealloced_internal_structs(htab);
else
htab_free_malloced_internal_structs(htab);
}

/* Called when map->refcnt goes to zero, either from workqueue or from syscall */
Expand Down
17 changes: 12 additions & 5 deletions kernel/bpf/verifier.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8464,6 +8464,9 @@ static int check_map_field_pointer(struct bpf_verifier_env *env, u32 regno,
case BPF_TASK_WORK:
field_off = map->record->task_work_off;
break;
case BPF_WORKQUEUE:
field_off = map->record->wq_off;
break;
default:
verifier_bug(env, "unsupported BTF field type: %s\n", struct_name);
return -EINVAL;
Expand Down Expand Up @@ -8505,13 +8508,17 @@ static int process_wq_func(struct bpf_verifier_env *env, int regno,
{
struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
struct bpf_map *map = reg->map_ptr;
u64 val = reg->var_off.value;
int err;

if (map->record->wq_off != val + reg->off) {
verbose(env, "off %lld doesn't point to 'struct bpf_wq' that is at %d\n",
val + reg->off, map->record->wq_off);
return -EINVAL;
err = check_map_field_pointer(env, regno, BPF_WORKQUEUE);
if (err)
return err;

if (meta->map.ptr) {
verifier_bug(env, "Two map pointers in a bpf_wq helper");
return -EFAULT;
}

meta->map.uid = reg->map_uid;
meta->map.ptr = map;
return 0;
Expand Down
Loading