Skip to content

Make TC BPF helpers preserve skb metadata #6218

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 16 commits into
base: bpf-next_base
Choose a base branch
from
Open

Make TC BPF helpers preserve skb metadata #6218

wants to merge 16 commits into from
+475 −183

Conversation

@kernel-patches-daemon-bpf-rc
Copy link

Pull request for series with
subject: Make TC BPF helpers preserve skb metadata
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: e758657
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: ff88079
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: f9db3a3
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 8842732
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 23f852d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 54c134f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 9f317bd
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 54c134f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: e2e668b
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: d28c0e4
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@jsitnicki
net: Helper to move packet data and metadata after skb_push/pull
959bfbe 
Lay groundwork for fixing BPF helpers available to TC(X) programs.

When skb_push() or skb_pull() is called in a TC(X) ingress BPF program, the
skb metadata must be kept in front of the MAC header. Otherwise, BPF
programs using the __sk_buff->data_meta pseudo-pointer lose access to it.

Introduce a helper that moves both metadata and a specified number of
packet data bytes together, suitable as a drop-in replacement for
memmove().

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
net: Preserve metadata on pskb_expand_head
ae6ae3f 
pskb_expand_head() copies headroom, including skb metadata, into the newly
allocated head, but then clears the metadata. As a result, metadata is lost
when BPF helpers trigger an skb head reallocation.

Let the skb metadata remain in the newly created copy of head.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Unclone skb head on bpf_dynptr_write to skb metadata
bfadb1e 
Currently bpf_dynptr_from_skb_meta() marks the dynptr as read-only when
the skb is cloned, preventing writes to metadata.

Remove this restriction and unclone the skb head on bpf_dynptr_write() to
metadata, now that the metadata is preserved during uncloning. This makes
metadata dynptr consistent with skb dynptr, allowing writes regardless of
whether the skb is cloned.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
vlan: Make vlan_remove_tag return nothing
e73b5ca 
All callers ignore the return value.

Prepare to reorder memmove() after skb_pull() which is a common pattern.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Make bpf_skb_vlan_pop helper metadata-safe
5c99057 
Use the metadata-aware helper to move packet bytes after skb_pull(),
ensuring metadata remains valid after calling the BPF helper.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Make bpf_skb_vlan_push helper metadata-safe
c41ea52 
Use the metadata-aware helper to move packet bytes after skb_push(),
ensuring metadata remains valid after calling the BPF helper.

Also, take care to reserve sufficient headroom for metadata to fit.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Make bpf_skb_adjust_room metadata-safe
2cde9c9 
bpf_skb_adjust_room() may push or pull bytes from skb->data. In both cases,
skb metadata must be moved accordingly to stay accessible.

Replace existing memmove() calls, which only move payload, with a helper
that also handles metadata. Reserve enough space for metadata to fit after
skb_push.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Make bpf_skb_change_proto helper metadata-safe
4300f8f 
bpf_skb_change_proto reuses the same headroom operations as
bpf_skb_adjust_room, already updated to handle metadata safely.

The remaining step is to ensure that there is sufficient headroom to
accommodate metadata on skb_push().

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
bpf: Make bpf_skb_change_head helper metadata-safe
fc0510d 
Although bpf_skb_change_head() doesn't move packet data after skb_push(),
skb metadata still needs to be relocated. Use the dedicated helper to
handle it.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Verify skb metadata in BPF instead of userspace
6a950b8 
Move metadata verification into the BPF TC programs. Previously,
userspace read metadata from a map and verified it once at test end.

Now TC programs compare metadata directly using __builtin_memcmp() and
set a test_pass flag. This enables verification at multiple points during
test execution rather than a single final check.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Dump skb metadata on verification failure
1bf81d6 
Add diagnostic output when metadata verification fails to help with
troubleshooting test failures. Introduce a check_metadata() helper that
prints both expected and received metadata to the BPF program's stderr
stream on mismatch. The userspace test reads and dumps this stream on
failure.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Expect unclone to preserve skb metadata
7c8a052 
Since pskb_expand_head() no longer clears metadata on unclone, update tests
for cloned packets to expect metadata to remain intact.

Also simplify the clone_dynptr_kept_on_{data,meta}_slice_write tests.
Creating an r/w dynptr slice is sufficient to trigger an unclone in the
prologue, so remove the extraneous writes to the data/meta slice.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Cover skb metadata access after vlan push/pop helper
3f38128 
Add a test to verify that skb metadata remains accessible after calling
bpf_skb_vlan_push() and bpf_skb_vlan_pop(), which modify the packet
headroom.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Cover skb metadata access after bpf_skb_adjust_room
c616512 
Add a test to verify that skb metadata remains accessible after calling
bpf_skb_adjust_room(), which modifies the packet headroom and can trigger
head reallocation.

The helper expects an Ethernet frame carrying an IP packet so switch test
packet identification by source MAC address since we can no longer rely on
Ethernet proto being set to zero.

Signed-off-by: Jakub Sitnicki <[email protected]>
@jsitnicki
selftests/bpf: Cover skb metadata access after change_head/tail helper
f8c378e 
Add a test to verify that skb metadata remains accessible after calling
bpf_skb_change_head() and bpf_skb_change_tail(), which modify packet
headroom/tailroom and can trigger head reallocation.

Signed-off-by: Jakub Sitnicki <[email protected]>
@kernel-patches-daemon-bpf-rc
Copy link
Author

Upstream branch: 5701d5a
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1015900
version: 3

@jsitnicki
selftests/bpf: Cover skb metadata access after bpf_skb_change_proto
6b57e73 
Add a test to verify that skb metadata remains accessible after calling
bpf_skb_change_proto(), which modifies packet headroom to accommodate
different IP header sizes.

Signed-off-by: Jakub Sitnicki <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bpf-next new V3-ci-fail V3

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsitnicki