1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (c) 2017 Facebook
3 */
4#include <linux/slab.h>
5#include <linux/bpf.h>
6#include <linux/btf.h>
7
8#include "map_in_map.h"
9
10struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)
11{
12	struct bpf_map *inner_map, *inner_map_meta;
13	u32 inner_map_meta_size;
14	struct fd f;
15	int ret;
16
17	f = fdget(inner_map_ufd);
18	inner_map = __bpf_map_get(f);
19	if (IS_ERR(inner_map))
20		return inner_map;
21
22	/* Does not support >1 level map-in-map */
23	if (inner_map->inner_map_meta) {
24		ret = -EINVAL;
25		goto put;
26	}
27
28	if (!inner_map->ops->map_meta_equal) {
29		ret = -ENOTSUPP;
30		goto put;
31	}
32
33	inner_map_meta_size = sizeof(*inner_map_meta);
34	/* In some cases verifier needs to access beyond just base map. */
35	if (inner_map->ops == &array_map_ops)
36		inner_map_meta_size = sizeof(struct bpf_array);
37
38	inner_map_meta = kzalloc(inner_map_meta_size, GFP_USER);
39	if (!inner_map_meta) {
40		ret = -ENOMEM;
41		goto put;
42	}
43
44	inner_map_meta->map_type = inner_map->map_type;
45	inner_map_meta->key_size = inner_map->key_size;
46	inner_map_meta->value_size = inner_map->value_size;
47	inner_map_meta->map_flags = inner_map->map_flags;
48	inner_map_meta->max_entries = inner_map->max_entries;
49
50	inner_map_meta->record = btf_record_dup(inner_map->record);
51	if (IS_ERR(inner_map_meta->record)) {
52		/* btf_record_dup returns NULL or valid pointer in case of
53		 * invalid/empty/valid, but ERR_PTR in case of errors. During
54		 * equality NULL or IS_ERR is equivalent.
55		 */
56		ret = PTR_ERR(inner_map_meta->record);
57		goto free;
58	}
59	/* Note: We must use the same BTF, as we also used btf_record_dup above
60	 * which relies on BTF being same for both maps, as some members like
61	 * record->fields.list_head have pointers like value_rec pointing into
62	 * inner_map->btf.
63	 */
64	if (inner_map->btf) {
65		btf_get(inner_map->btf);
66		inner_map_meta->btf = inner_map->btf;
67	}
68
69	/* Misc members not needed in bpf_map_meta_equal() check. */
70	inner_map_meta->ops = inner_map->ops;
71	if (inner_map->ops == &array_map_ops) {
72		struct bpf_array *inner_array_meta =
73			container_of(inner_map_meta, struct bpf_array, map);
74		struct bpf_array *inner_array = container_of(inner_map, struct bpf_array, map);
75
76		inner_array_meta->index_mask = inner_array->index_mask;
77		inner_array_meta->elem_size = inner_array->elem_size;
78		inner_map_meta->bypass_spec_v1 = inner_map->bypass_spec_v1;
79	}
80
81	fdput(f);
82	return inner_map_meta;
83free:
84	kfree(inner_map_meta);
85put:
86	fdput(f);
87	return ERR_PTR(ret);
88}
89
90void bpf_map_meta_free(struct bpf_map *map_meta)
91{
92	bpf_map_free_record(map_meta);
93	btf_put(map_meta->btf);
94	kfree(map_meta);
95}
96
97bool bpf_map_meta_equal(const struct bpf_map *meta0,
98			const struct bpf_map *meta1)
99{
100	/* No need to compare ops because it is covered by map_type */
101	return meta0->map_type == meta1->map_type &&
102		meta0->key_size == meta1->key_size &&
103		meta0->value_size == meta1->value_size &&
104		meta0->map_flags == meta1->map_flags &&
105		btf_record_equal(meta0->record, meta1->record);
106}
107
108void *bpf_map_fd_get_ptr(struct bpf_map *map,
109			 struct file *map_file /* not used */,
110			 int ufd)
111{
112	struct bpf_map *inner_map, *inner_map_meta;
113	struct fd f;
114
115	f = fdget(ufd);
116	inner_map = __bpf_map_get(f);
117	if (IS_ERR(inner_map))
118		return inner_map;
119
120	inner_map_meta = map->inner_map_meta;
121	if (inner_map_meta->ops->map_meta_equal(inner_map_meta, inner_map))
122		bpf_map_inc(inner_map);
123	else
124		inner_map = ERR_PTR(-EINVAL);
125
126	fdput(f);
127	return inner_map;
128}
129
130void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
131{
132	struct bpf_map *inner_map = ptr;
133
134	/* Defer the freeing of inner map according to the sleepable attribute
135	 * of bpf program which owns the outer map, so unnecessary waiting for
136	 * RCU tasks trace grace period can be avoided.
137	 */
138	if (need_defer) {
139		if (atomic64_read(&map->sleepable_refcnt))
140			WRITE_ONCE(inner_map->free_after_mult_rcu_gp, true);
141		else
142			WRITE_ONCE(inner_map->free_after_rcu_gp, true);
143	}
144	bpf_map_put(inner_map);
145}
146
147u32 bpf_map_fd_sys_lookup_elem(void *ptr)
148{
149	return ((struct bpf_map *)ptr)->id;
150}
151