kernel_samsung_sm7125

jenna

Andrey Ignatov adeed1f7db BACKPORT: bpf: Hooks for sys_connect == The problem == See description of the problem in the initial patch of this patch set. == The solution == The patch provides much more reliable in-kernel solution for the 2nd part of the problem: making outgoing connecttion from desired IP. It adds new attach types `BPF_CGROUP_INET4_CONNECT` and `BPF_CGROUP_INET6_CONNECT` for program type `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` that can be used to override both source and destination of a connection at connect(2) time. Local end of connection can be bound to desired IP using newly introduced BPF-helper `bpf_bind()`. It allows to bind to only IP though, and doesn't support binding to port, i.e. leverages `IP_BIND_ADDRESS_NO_PORT` socket option. There are two reasons for this: * looking for a free port is expensive and can affect performance significantly; * there is no use-case for port. As for remote end (`struct sockaddr *` passed by user), both parts of it can be overridden, remote IP and remote port. It's useful if an application inside cgroup wants to connect to another application inside same cgroup or to itself, but knows nothing about IP assigned to the cgroup. Support is added for IPv4 and IPv6, for TCP and UDP. IPv4 and IPv6 have separate attach types for same reason as sys_bind hooks, i.e. to prevent reading from / writing to e.g. user_ip6 fields when user passes sockaddr_in since it'd be out-of-bound. == Implementation notes == The patch introduces new field in `struct proto`: `pre_connect` that is a pointer to a function with same signature as `connect` but is called before it. The reason is in some cases BPF hooks should be called way before control is passed to `sk->sk_prot->connect`. Specifically `inet_dgram_connect` autobinds socket before calling `sk->sk_prot->connect` and there is no way to call `bpf_bind()` from hooks from e.g. `ip4_datagram_connect` or `ip6_datagram_connect` since it'd cause double-bind. On the other hand `proto.pre_connect` provides a flexible way to add BPF hooks for connect only for necessary `proto` and call them at desired time before `connect`. Since `bpf_bind()` is allowed to bind only to IP and autobind in `inet_dgram_connect` binds only port there is no chance of double-bind. bpf_bind() sets `force_bind_address_no_port` to bind to only IP despite of value of `bind_address_no_port` socket field. bpf_bind() sets `with_lock` to `false` when calling to __inet_bind() and __inet6_bind() since all call-sites, where bpf_bind() is called, already hold socket lock. Change-Id: I03eb513369c630b203466621d1fbdb9b29c8333c Signed-off-by: Andrey Ignatov <rdna@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		9 months ago
Documentation	bpf: Add kconfig knob for disabling unpriv bpf by default	11 months ago
arch	powerpc/bpf: Fix BPF_MOD when imm == 1	11 months ago
block	A525FXXU4CVJB	2 years ago
certs	…
crypto	…
drivers	BACKPORT: net: bpf: rename ndo_xdp to ndo_bpf	9 months ago
firmware	A525FXXU4CVJB	2 years ago
fs	A525FXXU4CVJB	2 years ago
include	BACKPORT: bpf: Hooks for sys_connect	9 months ago
init	bpf: Add kconfig knob for disabling unpriv bpf by default	11 months ago
ipc	…
kernel	BACKPORT: bpf: Hooks for sys_connect	9 months ago
lib	bpf: add also cbpf long jump test cases with heavy expansion	11 months ago
mm	mm: Fix a -Werror=strict-prototypes compilation error from clang 15	11 months ago
net	BACKPORT: bpf: Hooks for sys_connect	9 months ago
samples	samples/bpf: Fix the error return code of xdp_redirect's main()	11 months ago
scripts	fixup! bpf: Update logging functions to work with BTF	9 months ago
security	UPSTREAM: security: selinux: allow per-file labeling for bpffs	11 months ago
sound	A525FXXU4CVJB	2 years ago
techpack	A525FXXU4CVJB	2 years ago
tools	bpf: Fix the off-by-two error in range markings	11 months ago
usr	…
virt	Import A525FXXU3AUG4	3 years ago
.cocciconfig	…
.get_maintainer.ignore	…
.gitattributes	…
.gitignore	…
.mailmap	…
Android.mk	…
AndroidKernel.mk	…
Androidbp	…
COPYING	…
CREDITS	…
Kbuild	…
Kconfig	…
MAINTAINERS	…
Makefile	Makefile: Move -Wno-unused-but-set-variable out of GCC only block	2 years ago
README	…
build.config.aarch64	…
build.config.common	…
build.config.cuttlefish.aarch64	…
build.config.cuttlefish.x86_64	…
build.config.goldfish.arm	…
build.config.goldfish.arm64	…
build.config.goldfish.mips	…
build.config.goldfish.mips64	…
build.config.goldfish.x86	…
build.config.goldfish.x86_64	…
build.config.x86_64	…
disable_dbgfs.sh	…
gen_headers_arm.bp	…
gen_headers_arm64.bp	…
kernel_headers.py	…
verity_dev_keys.x509	…

README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.