Re: [PATCH bpf-next V9 1/3] bpf: new helper to obtain namespace data from current task

On 8/20/19 8:10 AM, Carlos Antonio Neira Bustos wrote:

Hi Yonghong,

Thanks for taking the time to review this.

quoted

quoted

+ *
+ *		**-EINVAL** if *size_of_pidns* is not valid or unable to get ns, pid
+ *		or tgid of the current task.
+ *
+ *		**-ECHILD** if /proc/self/ns/pid does not exists.
+ *
+ *		**-ENOTDIR** if /proc/self/ns does not exists.

Let us remove ECHILD and ENOTDIR and replace it with ENOENT as I
described below.

Please *do verify* what happens when namespaces or pid_ns are not
configured.

I have tested kernel configurations without namespace support and with
namespace support but without pid namespaces, the helper returns -EINVAL
on both cases, now it should return -ENOENT.

Indeed. -ENOENT is better.

quoted

quoted

+struct bpf_pidns_info {
+	__u32 dev;

Please add a comment for dev for how device major and minor number are
derived. User space gets device major and minor number, they need to
compare to the corresponding major/minor numbers returned by this helper.

quoted

+	__u32 nsid;
+	__u32 tgid;
+	__u32 pid;
+};

What do you think of this comment ?

struct bpf_pidns_info {
	__u32 dev;	/* major/minor numbers from /proc/self/ns/pid.
			 * User space gets device major and minor numbers from
			 * the same device that need to be compared against the
			 * major/minor numbers returned by this helper.
			 */
	__u32 nsid;
	__u32 tgid;
	__u32 pid;
};

To be more specific, I like a comment similar to below in uapi bpf.h

struct bpf_cgroup_dev_ctx {
         /* access_type encoded as (BPF_DEVCG_ACC_* << 16) | 
BPF_DEVCG_DEV_* */
         __u32 access_type;
         __u32 major;
         __u32 minor;
};

Some like:
	/* dev encoded as (major << 8 | (minor & 0xff)) */

quoted

Please put an empty line. As a general rule for readability,
put an empty line if control flow is interrupted, e.g., by
"return", "break" or "continue". At least this is what
I saw most in bpf mailing list.

I'll fix it in version 10.

quoted

quoted

+	len = strlen(pidns_path) + 1;
+	memcpy((char *)tmp->name, pidns_path, len);
+	tmp->uptr = NULL;
+	tmp->aname = NULL;
+	tmp->refcnt = 1;
+	ret = filename_lookup(AT_FDCWD, tmp, 0, &kp, NULL);

Adding below to free kmem cache memory
	kmem_cache_free(names_cachep, fname);

I think we don't need to call kmem_cache_free as filename_lookup
calls putname that calls kmem_cache_free.

Oh, right. Thanks for checking this.

Thanks a lot for your help.

Bests

quoted

In the above, we checked task_active_pid_ns().
If not returning NULL, we have a valid pid ns. So the above
filename_lookup should not go wrong. We can still keep
the error checking though.

quoted

+	if (ret) {
+		memset((void *)pidns_info, 0, (size_t) size);
+		return ret;

I think we could get rid of this.