Skip to content

Commit 2b8a72f

Browse files
AsphalttKernel Patches Daemon
Asphaltt
authored and
Kernel Patches Daemon
committed
bpf: Prevent tailcall infinite loop caused by freplace
This patch prevents an infinite loop issue caused by combination of tailcall and freplace. For example: tc_bpf2bpf.c: // SPDX-License-Identifier: GPL-2.0 \#include <linux/bpf.h> \#include <bpf/bpf_helpers.h> __noinline int subprog_tc(struct __sk_buff *skb) { return skb->len * 2; } SEC("tc") int entry_tc(struct __sk_buff *skb) { return subprog_tc(skb); } char __license[] SEC("license") = "GPL"; tailcall_freplace.c: // SPDX-License-Identifier: GPL-2.0 \#include <linux/bpf.h> \#include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_PROG_ARRAY); __uint(max_entries, 1); __uint(key_size, sizeof(__u32)); __uint(value_size, sizeof(__u32)); } jmp_table SEC(".maps"); int count = 0; SEC("freplace") int entry_freplace(struct __sk_buff *skb) { count++; bpf_tail_call_static(skb, &jmp_table, 0); return count; } char __license[] SEC("license") = "GPL"; The attach target of entry_freplace is subprog_tc, and the tail callee in entry_freplace is entry_tc. Then, the infinite loop will be entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc, because tail_call_cnt in entry_freplace will count from zero for every time of entry_freplace execution. Kernel will panic, like: [ 15.310490] BUG: TASK stack guard page was hit at (____ptrval____) (stack is (____ptrval____)..(____ptrval____)) [ 15.310490] Oops: stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 15.310490] CPU: 1 PID: 89 Comm: test_progs Tainted: G OE 6.10.0-rc6-g026dcdae8d3e-dirty #72 [ 15.310490] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.310490] RIP: 0010:bpf_prog_3a140cef239a4b4f_subprog_tail+0x14/0x53 [ 15.310490] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 0f 1f 00 55 48 89 e5 f3 0f 1e fa <50> 50 53 41 55 48 89 fb 49 bd 00 2a 46 82 98 9c ff ff 48 89 df 4c [ 15.310490] RSP: 0018:ffffb500c0aa0000 EFLAGS: 00000202 [ 15.310490] RAX: ffffb500c0aa0028 RBX: ffff9c98808b7e00 RCX: 0000000000008cb5 [ 15.310490] RDX: 0000000000000000 RSI: ffff9c9882462a00 RDI: ffff9c98808b7e00 [ 15.310490] RBP: ffffb500c0aa0000 R08: 0000000000000000 R09: 0000000000000000 [ 15.310490] R10: 0000000000000001 R11: 0000000000000000 R12: ffffb500c01af000 [ 15.310490] R13: ffffb500c01cd000 R14: 0000000000000000 R15: 0000000000000000 [ 15.310490] FS: 00007f133b665140(0000) GS:ffff9c98bbd00000(0000) knlGS:0000000000000000 [ 15.310490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.310490] CR2: ffffb500c0a9fff8 CR3: 0000000102478000 CR4: 00000000000006f0 [ 15.310490] Call Trace: [ 15.310490] <#DF> [ 15.310490] ? die+0x36/0x90 [ 15.310490] ? handle_stack_overflow+0x4d/0x60 [ 15.310490] ? exc_double_fault+0x117/0x1a0 [ 15.310490] ? asm_exc_double_fault+0x23/0x30 [ 15.310490] ? bpf_prog_3a140cef239a4b4f_subprog_tail+0x14/0x53 [ 15.310490] </#DF> [ 15.310490] <TASK> [ 15.310490] bpf_prog_85781a698094722f_entry+0x4c/0x64 [ 15.310490] bpf_prog_1c515f389a9059b4_entry2+0x19/0x1b [ 15.310490] ... [ 15.310490] bpf_prog_85781a698094722f_entry+0x4c/0x64 [ 15.310490] bpf_prog_1c515f389a9059b4_entry2+0x19/0x1b [ 15.310490] bpf_test_run+0x210/0x370 [ 15.310490] ? bpf_test_run+0x128/0x370 [ 15.310490] bpf_prog_test_run_skb+0x388/0x7a0 [ 15.310490] __sys_bpf+0xdbf/0x2c40 [ 15.310490] ? clockevents_program_event+0x52/0xf0 [ 15.310490] ? lock_release+0xbf/0x290 [ 15.310490] __x64_sys_bpf+0x1e/0x30 [ 15.310490] do_syscall_64+0x68/0x140 [ 15.310490] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 15.310490] RIP: 0033:0x7f133b52725d [ 15.310490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48 [ 15.310490] RSP: 002b:00007ffddbc10258 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [ 15.310490] RAX: ffffffffffffffda RBX: 00007ffddbc10828 RCX: 00007f133b52725d [ 15.310490] RDX: 0000000000000050 RSI: 00007ffddbc102a0 RDI: 000000000000000a [ 15.310490] RBP: 00007ffddbc10270 R08: 0000000000000000 R09: 00007ffddbc102a0 [ 15.310490] R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000004 [ 15.310490] R13: 0000000000000000 R14: 0000558ec4c24890 R15: 00007f133b6ed000 [ 15.310490] </TASK> [ 15.310490] Modules linked in: bpf_testmod(OE) [ 15.310490] ---[ end trace 0000000000000000 ]--- [ 15.310490] RIP: 0010:bpf_prog_3a140cef239a4b4f_subprog_tail+0x14/0x53 [ 15.310490] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 0f 1f 00 55 48 89 e5 f3 0f 1e fa <50> 50 53 41 55 48 89 fb 49 bd 00 2a 46 82 98 9c ff ff 48 89 df 4c [ 15.310490] RSP: 0018:ffffb500c0aa0000 EFLAGS: 00000202 [ 15.310490] RAX: ffffb500c0aa0028 RBX: ffff9c98808b7e00 RCX: 0000000000008cb5 [ 15.310490] RDX: 0000000000000000 RSI: ffff9c9882462a00 RDI: ffff9c98808b7e00 [ 15.310490] RBP: ffffb500c0aa0000 R08: 0000000000000000 R09: 0000000000000000 [ 15.310490] R10: 0000000000000001 R11: 0000000000000000 R12: ffffb500c01af000 [ 15.310490] R13: ffffb500c01cd000 R14: 0000000000000000 R15: 0000000000000000 [ 15.310490] FS: 00007f133b665140(0000) GS:ffff9c98bbd00000(0000) knlGS:0000000000000000 [ 15.310490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.310490] CR2: ffffb500c0a9fff8 CR3: 0000000102478000 CR4: 00000000000006f0 [ 15.310490] Kernel panic - not syncing: Fatal exception in interrupt [ 15.310490] Kernel Offset: 0x30000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) This patch prevents this panic by preventing updating extended prog to prog_array map and preventing extending a prog, which has been updated to prog_array map, with freplace prog. If a prog or its subprog has been extended by freplace prog, the prog can not be updated to prog_array map. If a prog has been updated to prog_array map, it or its subprog can not be extended by freplace prog. BTW, fix a minor code style issue by replacing 8 spaces with a tab. Reported-by: kernel test robot <[email protected]> Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/ Signed-off-by: Leon Hwang <[email protected]> Reviewed-by: Eduard Zingerman <[email protected]>
1 parent 20390c4 commit 2b8a72f

File tree

5 files changed

+102
-7
lines changed

5 files changed

+102
-7
lines changed

‎include/linux/bpf.h

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1294,6 +1294,12 @@ bool __bpf_dynptr_is_rdonly(const struct bpf_dynptr_kern *ptr);
12941294
#ifdef CONFIG_BPF_JIT
12951295
int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
12961296
int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr);
1297+
int bpf_extension_link_prog(struct bpf_tramp_link *link,
1298+
struct bpf_trampoline *tr,
1299+
struct bpf_prog *tgt_prog);
1300+
int bpf_extension_unlink_prog(struct bpf_tramp_link *link,
1301+
struct bpf_trampoline *tr,
1302+
struct bpf_prog *tgt_prog);
12971303
struct bpf_trampoline *bpf_trampoline_get(u64 key,
12981304
struct bpf_attach_target_info *tgt_info);
12991305
void bpf_trampoline_put(struct bpf_trampoline *tr);
@@ -1383,6 +1389,18 @@ static inline int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link,
13831389
{
13841390
return -ENOTSUPP;
13851391
}
1392+
static inline int bpf_extension_link_prog(struct bpf_tramp_link *link,
1393+
struct bpf_trampoline *tr,
1394+
struct bpf_prog *tgt_prog)
1395+
{
1396+
return -ENOTSUPP;
1397+
}
1398+
static inline int bpf_extension_unlink_prog(struct bpf_tramp_link *link,
1399+
struct bpf_trampoline *tr,
1400+
struct bpf_prog *tgt_prog)
1401+
{
1402+
return -ENOTSUPP;
1403+
}
13861404
static inline struct bpf_trampoline *bpf_trampoline_get(u64 key,
13871405
struct bpf_attach_target_info *tgt_info)
13881406
{
@@ -1483,6 +1501,9 @@ struct bpf_prog_aux {
14831501
bool xdp_has_frags;
14841502
bool exception_cb;
14851503
bool exception_boundary;
1504+
bool is_extended; /* true if extended by freplace program */
1505+
u64 prog_array_member_cnt; /* counts how many times as member of prog_array */
1506+
struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */
14861507
struct bpf_arena *arena;
14871508
/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
14881509
const struct btf_type *attach_func_proto;

‎kernel/bpf/arraymap.c

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -947,6 +947,7 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
947947
struct file *map_file, int fd)
948948
{
949949
struct bpf_prog *prog = bpf_prog_get(fd);
950+
bool is_extended;
950951

951952
if (IS_ERR(prog))
952953
return prog;
@@ -956,13 +957,33 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
956957
return ERR_PTR(-EINVAL);
957958
}
958959

960+
mutex_lock(&prog->aux->ext_mutex);
961+
is_extended = prog->aux->is_extended;
962+
if (!is_extended)
963+
prog->aux->prog_array_member_cnt++;
964+
mutex_unlock(&prog->aux->ext_mutex);
965+
if (is_extended) {
966+
/* Extended prog can not be tail callee. It's to prevent a
967+
* potential infinite loop like:
968+
* tail callee prog entry -> tail callee prog subprog ->
969+
* freplace prog entry --tailcall-> tail callee prog entry.
970+
*/
971+
bpf_prog_put(prog);
972+
return ERR_PTR(-EBUSY);
973+
}
974+
959975
return prog;
960976
}
961977

962978
static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
963979
{
980+
struct bpf_prog *prog = ptr;
981+
982+
mutex_lock(&prog->aux->ext_mutex);
983+
prog->aux->prog_array_member_cnt--;
984+
mutex_unlock(&prog->aux->ext_mutex);
964985
/* bpf_prog is freed after one RCU or tasks trace grace period */
965-
bpf_prog_put(ptr);
986+
bpf_prog_put(prog);
966987
}
967988

968989
static u32 prog_fd_array_sys_lookup_elem(void *ptr)

‎kernel/bpf/core.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flag
131131
INIT_LIST_HEAD_RCU(&fp->aux->ksym_prefix.lnode);
132132
#endif
133133
mutex_init(&fp->aux->used_maps_mutex);
134+
mutex_init(&fp->aux->ext_mutex);
134135
mutex_init(&fp->aux->dst_mutex);
135136

136137
return fp;

‎kernel/bpf/syscall.c

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3212,15 +3212,21 @@ static void bpf_tracing_link_release(struct bpf_link *link)
32123212
{
32133213
struct bpf_tracing_link *tr_link =
32143214
container_of(link, struct bpf_tracing_link, link.link);
3215+
struct bpf_prog *tgt_prog = tr_link->tgt_prog;
32153216

3216-
WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link,
3217-
tr_link->trampoline));
3217+
if (link->prog->type == BPF_PROG_TYPE_EXT)
3218+
WARN_ON_ONCE(bpf_extension_unlink_prog(&tr_link->link,
3219+
tr_link->trampoline,
3220+
tgt_prog));
3221+
else
3222+
WARN_ON_ONCE(bpf_trampoline_unlink_prog(&tr_link->link,
3223+
tr_link->trampoline));
32183224

32193225
bpf_trampoline_put(tr_link->trampoline);
32203226

32213227
/* tgt_prog is NULL if target is a kernel function */
3222-
if (tr_link->tgt_prog)
3223-
bpf_prog_put(tr_link->tgt_prog);
3228+
if (tgt_prog)
3229+
bpf_prog_put(tgt_prog);
32243230
}
32253231

32263232
static void bpf_tracing_link_dealloc(struct bpf_link *link)
@@ -3354,7 +3360,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
33543360
* in prog->aux
33553361
*
33563362
* - if prog->aux->dst_trampoline is NULL, the program has already been
3357-
* attached to a target and its initial target was cleared (below)
3363+
* attached to a target and its initial target was cleared (below)
33583364
*
33593365
* - if tgt_prog != NULL, the caller specified tgt_prog_fd +
33603366
* target_btf_id using the link_create API.
@@ -3429,7 +3435,10 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
34293435
if (err)
34303436
goto out_unlock;
34313437

3432-
err = bpf_trampoline_link_prog(&link->link, tr);
3438+
if (prog->type == BPF_PROG_TYPE_EXT)
3439+
err = bpf_extension_link_prog(&link->link, tr, tgt_prog);
3440+
else
3441+
err = bpf_trampoline_link_prog(&link->link, tr);
34333442
if (err) {
34343443
bpf_link_cleanup(&link_primer);
34353444
link = NULL;

‎kernel/bpf/trampoline.c

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,35 @@ int bpf_trampoline_link_prog(struct bpf_tramp_link *link, struct bpf_trampoline
580580
return err;
581581
}
582582

583+
int bpf_extension_link_prog(struct bpf_tramp_link *link,
584+
struct bpf_trampoline *tr,
585+
struct bpf_prog *tgt_prog)
586+
{
587+
struct bpf_prog_aux *aux = tgt_prog->aux;
588+
int err;
589+
590+
mutex_lock(&aux->ext_mutex);
591+
if (aux->prog_array_member_cnt) {
592+
/* Program extensions can not extend target prog when the target
593+
* prog has been updated to any prog_array map as tail callee.
594+
* It's to prevent a potential infinite loop like:
595+
* tgt prog entry -> tgt prog subprog -> freplace prog entry
596+
* --tailcall-> tgt prog entry.
597+
*/
598+
err = -EBUSY;
599+
goto out_unlock;
600+
}
601+
602+
err = bpf_trampoline_link_prog(link, tr);
603+
if (err)
604+
goto out_unlock;
605+
606+
aux->is_extended = true;
607+
out_unlock:
608+
mutex_unlock(&aux->ext_mutex);
609+
return err;
610+
}
611+
583612
static int __bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampoline *tr)
584613
{
585614
enum bpf_tramp_prog_type kind;
@@ -609,6 +638,20 @@ int bpf_trampoline_unlink_prog(struct bpf_tramp_link *link, struct bpf_trampolin
609638
return err;
610639
}
611640

641+
int bpf_extension_unlink_prog(struct bpf_tramp_link *link,
642+
struct bpf_trampoline *tr,
643+
struct bpf_prog *tgt_prog)
644+
{
645+
struct bpf_prog_aux *aux = tgt_prog->aux;
646+
int err;
647+
648+
mutex_lock(&aux->ext_mutex);
649+
err = bpf_trampoline_unlink_prog(link, tr);
650+
aux->is_extended = false;
651+
mutex_unlock(&aux->ext_mutex);
652+
return err;
653+
}
654+
612655
#if defined(CONFIG_CGROUP_BPF) && defined(CONFIG_BPF_LSM)
613656
static void bpf_shim_tramp_link_release(struct bpf_link *link)
614657
{

0 commit comments

Comments
 (0)