bpf: map_get_next_key to return first key on NULL

commit 8fe45924387be6b5c1be59a7eb330790c61d5d10 upstream.

When iterating through a map, we need to find a key that does not exist
in the map so map_get_next_key will give us the first key of the map.
This often requires a lot of guessing in production systems.

This patch makes map_get_next_key return the first key when the key
pointer in the parameter is NULL.

Signed-off-by: Teng Qin <qinteng@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chenbo Feng <fengc@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 3608fa1aec8a7065d4bec21fa03fd227b95392b9..0eb11b4ac4c7ac123560993e224e7cabaa6a07a9 100644 (file)
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -102,7 +102,7 @@ static void *array_map_lookup_elem(struct bpf_map *map, void *key)
 static int array_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
 {
        struct bpf_array *array = container_of(map, struct bpf_array, map);
-       u32 index = *(u32 *)key;
+       u32 index = key ? *(u32 *)key : U32_MAX;
        u32 *next = (u32 *)next_key;
 
        if (index >= array->map.max_entries) {

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 34777b3746fadf6407ca9805f33df608be619f21..a35abe0482390a144451ed0c58ef9eb393417e41 100644 (file)
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -169,12 +169,15 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
        struct hlist_head *head;
        struct htab_elem *l, *next_l;
        u32 hash, key_size;
-       int i;
+       int i = 0;
 
        WARN_ON_ONCE(!rcu_read_lock_held());
 
        key_size = map->key_size;
 
+       if (!key)
+               goto find_first_elem;
+
        hash = htab_map_hash(key, key_size);
 
        head = select_bucket(htab, hash);
@@ -182,10 +185,8 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
        /* lookup the key */
        l = lookup_elem_raw(head, hash, key, key_size);
 
-       if (!l) {
-               i = 0;
+       if (!l)
                goto find_first_elem;
-       }
 
        /* key was found, get next key in the same bucket */
        next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)),

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index dc19b6e210e64edb0272dedb2f1b2cc5b43ec294..4b9bbfe764e82aa9f81e97953c633dda4d317d38 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -390,14 +390,18 @@ static int map_get_next_key(union bpf_attr *attr)
        if (IS_ERR(map))
                return PTR_ERR(map);
 
-       err = -ENOMEM;
-       key = kmalloc(map->key_size, GFP_USER);
-       if (!key)
-               goto err_put;
-
-       err = -EFAULT;
-       if (copy_from_user(key, ukey, map->key_size) != 0)
-               goto free_key;
+       if (ukey) {
+               err = -ENOMEM;
+               key = kmalloc(map->key_size, GFP_USER);
+               if (!key)
+                       goto err_put;
+
+               err = -EFAULT;
+               if (copy_from_user(key, ukey, map->key_size) != 0)
+                       goto free_key;
+       } else {
+               key = NULL;
+       }
 
        err = -ENOMEM;
        next_key = kmalloc(map->key_size, GFP_USER);