Commit 1d712839 authored by David Vernet's avatar David Vernet Committed by Alexei Starovoitov
Browse files

bpf: Make bpf_cgroup_acquire() KF_RCU | KF_RET_NULL 



struct cgroup is already an RCU-safe type in the verifier. We can
therefore update bpf_cgroup_acquire() to be KF_RCU | KF_RET_NULL, and
subsequently remove bpf_cgroup_kptr_get(). This patch does the first of
these by updating bpf_cgroup_acquire() to be KF_RCU | KF_RET_NULL, and
also updates selftests accordingly.

Signed-off-by: default avatarDavid Vernet <void@manifault.com>
Link: https://lore.kernel.org/r/20230411041633.179404-1-void@manifault.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 10fd5f70

kernel/bpf/helpers.c

+2 −3
Original line number Diff line number Diff line
@@ -2037,8 +2037,7 @@ __bpf_kfunc void bpf_task_release(struct task_struct *p) 
 */

__bpf_kfunc struct cgroup *bpf_cgroup_acquire(struct cgroup *cgrp)

{

	cgroup_get(cgrp);

	return cgrp;

	return cgroup_tryget(cgrp) ? cgrp : NULL;

}



/**
@@ -2314,7 +2313,7 @@ BTF_ID_FLAGS(func, bpf_rbtree_add) 
BTF_ID_FLAGS(func, bpf_rbtree_first, KF_RET_NULL)



#ifdef CONFIG_CGROUPS

BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_cgroup_acquire, KF_ACQUIRE | KF_RCU | KF_RET_NULL)

BTF_ID_FLAGS(func, bpf_cgroup_kptr_get, KF_ACQUIRE | KF_KPTR_GET | KF_RET_NULL)

BTF_ID_FLAGS(func, bpf_cgroup_release, KF_RELEASE)

BTF_ID_FLAGS(func, bpf_cgroup_ancestor, KF_ACQUIRE | KF_RCU | KF_RET_NULL)

tools/testing/selftests/bpf/progs/cgrp_kfunc_common.h

+5 −0
Original line number Diff line number Diff line
@@ -61,6 +61,11 @@ static inline int cgrps_kfunc_map_insert(struct cgroup *cgrp) 
	}



	acquired = bpf_cgroup_acquire(cgrp);

	if (!acquired) {

		bpf_map_delete_elem(&__cgrps_kfunc_map, &id);

		return -ENOENT;

	}



	old = bpf_kptr_xchg(&v->cgrp, acquired);

	if (old) {

		bpf_cgroup_release(old);

tools/testing/selftests/bpf/progs/cgrp_kfunc_failure.c

+29 −6
Original line number Diff line number Diff line
@@ -41,6 +41,23 @@ int BPF_PROG(cgrp_kfunc_acquire_untrusted, struct cgroup *cgrp, const char *path 


	/* Can't invoke bpf_cgroup_acquire() on an untrusted pointer. */

	acquired = bpf_cgroup_acquire(v->cgrp);

	if (acquired)

		bpf_cgroup_release(acquired);



	return 0;

}



SEC("tp_btf/cgroup_mkdir")

__failure __msg("Possibly NULL pointer passed to trusted arg0")

int BPF_PROG(cgrp_kfunc_acquire_no_null_check, struct cgroup *cgrp, const char *path)

{

	struct cgroup *acquired;



	acquired = bpf_cgroup_acquire(cgrp);

	/*

	 * Can't invoke bpf_cgroup_release() without checking the return value

	 * of bpf_cgroup_acquire().

	 */

	bpf_cgroup_release(acquired);



	return 0;
@@ -54,6 +71,7 @@ int BPF_PROG(cgrp_kfunc_acquire_fp, struct cgroup *cgrp, const char *path) 


	/* Can't invoke bpf_cgroup_acquire() on a random frame pointer. */

	acquired = bpf_cgroup_acquire((struct cgroup *)&stack_cgrp);

	if (acquired)

		bpf_cgroup_release(acquired);



	return 0;
@@ -67,6 +85,7 @@ int BPF_PROG(cgrp_kfunc_acquire_unsafe_kretprobe, struct cgroup *cgrp) 


	/* Can't acquire an untrusted struct cgroup * pointer. */

	acquired = bpf_cgroup_acquire(cgrp);

	if (acquired)

		bpf_cgroup_release(acquired);



	return 0;
@@ -80,6 +99,7 @@ int BPF_PROG(cgrp_kfunc_acquire_trusted_walked, struct cgroup *cgrp, const char 


	/* Can't invoke bpf_cgroup_acquire() on a pointer obtained from walking a trusted cgroup. */

	acquired = bpf_cgroup_acquire(cgrp->old_dom_cgrp);

	if (acquired)

		bpf_cgroup_release(acquired);



	return 0;
@@ -93,8 +113,7 @@ int BPF_PROG(cgrp_kfunc_acquire_null, struct cgroup *cgrp, const char *path) 


	/* Can't invoke bpf_cgroup_acquire() on a NULL pointer. */

	acquired = bpf_cgroup_acquire(NULL);

	if (!acquired)

		return 0;

	if (acquired)

		bpf_cgroup_release(acquired);



	return 0;
@@ -137,6 +156,8 @@ int BPF_PROG(cgrp_kfunc_get_non_kptr_acquired, struct cgroup *cgrp, const char * 
	struct cgroup *kptr, *acquired;



	acquired = bpf_cgroup_acquire(cgrp);

	if (!acquired)

		return 0;



	/* Cannot use bpf_cgroup_kptr_get() on a non-map-value, even if the kptr was acquired. */

	kptr = bpf_cgroup_kptr_get(&acquired);
@@ -256,6 +277,8 @@ int BPF_PROG(cgrp_kfunc_release_null, struct cgroup *cgrp, const char *path) 
		return -ENOENT;



	acquired = bpf_cgroup_acquire(cgrp);

	if (!acquired)

		return -ENOENT;



	old = bpf_kptr_xchg(&v->cgrp, acquired);

tools/testing/selftests/bpf/progs/cgrp_kfunc_success.c

+4 −1
Original line number Diff line number Diff line
@@ -38,6 +38,9 @@ int BPF_PROG(test_cgrp_acquire_release_argument, struct cgroup *cgrp, const char 
		return 0;



	acquired = bpf_cgroup_acquire(cgrp);

	if (!acquired)

		err = 1;

	else

		bpf_cgroup_release(acquired);



	return 0;