diff mbox series

[bpf,3/3] selftests/bpf: Add test for cgroup iterator on a dead cgroup

Message ID 20221107074222.1323017-4-houtao@huaweicloud.com (mailing list archive)
State Changes Requested
Delegated to: BPF
Headers show
Series Pin the start cgroup for cgroup iterator | expand

Checks

Context Check Description
netdev/tree_selection success Clearly marked for bpf
netdev/fixes_present success Fixes tag present in non-next series
netdev/subject_prefix success Link
netdev/cover_letter success Series has a cover letter
netdev/patch_count success Link
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/cc_maintainers warning 3 maintainers not CCed: shuah@kernel.org mykolal@fb.com linux-kselftest@vger.kernel.org
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/module_param success Was 0 now: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 90 lines checked
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-VM_Test-16 success Logs for test_progs_no_alu32_parallel on s390x with gcc
bpf/vmtest-bpf-VM_Test-10 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-PR success PR summary
bpf/vmtest-bpf-VM_Test-7 success Logs for test_maps on s390x with gcc
bpf/vmtest-bpf-VM_Test-13 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-VM_Test-19 success Logs for test_progs_parallel on s390x with gcc
bpf/vmtest-bpf-VM_Test-1 pending Logs for ShellCheck
bpf/vmtest-bpf-VM_Test-5 success Logs for llvm-toolchain
bpf/vmtest-bpf-VM_Test-6 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-3 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-4 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-2 success Logs for build for s390x with gcc
bpf/vmtest-bpf-VM_Test-17 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-23 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-24 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-11 success Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-14 success Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-15 success Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-18 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-20 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-21 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-8 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-9 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-12 success Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-22 success Logs for test_verifier on s390x with gcc

Commit Message

Hou Tao Nov. 7, 2022, 7:42 a.m. UTC 
From: Hou Tao <houtao1@huawei.com>

The test closes both iterator link fd and cgroup fd, and removes the
cgroup file to make a dead cgroup before reading cgroup iterator fd. It
also uses kern_sync_rcu() and usleep() to wait for the release of
start cgroup. If the start cgroup is not pinned by cgroup iterator,
reading iterator fd will trigger use-after-free.

Signed-off-by: Hou Tao <houtao1@huawei.com>
---
 .../selftests/bpf/prog_tests/cgroup_iter.c    | 78 +++++++++++++++++++
 1 file changed, 78 insertions(+)

Comments

Yonghong Song Nov. 7, 2022, 10:44 p.m. UTC | #1 
On 11/6/22 11:42 PM, Hou Tao wrote:
> From: Hou Tao <houtao1@huawei.com>
> 
> The test closes both iterator link fd and cgroup fd, and removes the
> cgroup file to make a dead cgroup before reading cgroup iterator fd. It
> also uses kern_sync_rcu() and usleep() to wait for the release of
> start cgroup. If the start cgroup is not pinned by cgroup iterator,
> reading iterator fd will trigger use-after-free.
> 
> Signed-off-by: Hou Tao <houtao1@huawei.com>

LGTM with a few nits below.

Acked-by: Yonghong Song <yhs@fb.com>

> ---
>   .../selftests/bpf/prog_tests/cgroup_iter.c    | 78 +++++++++++++++++++
>   1 file changed, 78 insertions(+)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c b/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
> index c4a2adb38da1..d64ed1cf1554 100644
> --- a/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
> +++ b/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
> @@ -189,6 +189,82 @@ static void test_walk_self_only(struct cgroup_iter *skel)
>   			      BPF_CGROUP_ITER_SELF_ONLY, "self_only");
>   }
>   
> +static void test_walk_dead_self_only(struct cgroup_iter *skel)
> +{
> +	DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);
> +	char expected_output[128], buf[128];
> +	const char *cgrp_name = "/dead";
> +	union bpf_iter_link_info linfo;
> +	int len, cgrp_fd, iter_fd;
> +	struct bpf_link *link;
> +	size_t left;
> +	char *p;
> +
> +	cgrp_fd = create_and_get_cgroup(cgrp_name);
> +	if (!ASSERT_GE(cgrp_fd, 0, "create cgrp"))
> +		return;
> +
> +	/* The cgroup is already dead during iteration, so it only has epilogue
> +	 * in the output.
> +	 */

Let us reword the comment like
	The cgroup will be dead during read() iteration, and it only has
	epilogue in the output.

> +	snprintf(expected_output, sizeof(expected_output), EPILOGUE);
> +
> +	memset(&linfo, 0, sizeof(linfo));
> +	linfo.cgroup.cgroup_fd = cgrp_fd;
> +	linfo.cgroup.order = BPF_CGROUP_ITER_SELF_ONLY;
> +	opts.link_info = &linfo;
> +	opts.link_info_len = sizeof(linfo);
> +
> +	link = bpf_program__attach_iter(skel->progs.cgroup_id_printer, &opts);
> +	if (!ASSERT_OK_PTR(link, "attach_iter"))
> +		goto close_cg;
> +
> +	iter_fd = bpf_iter_create(bpf_link__fd(link));
> +	if (!ASSERT_GE(iter_fd, 0, "iter_create"))
> +		goto free_link;
> +
> +	/* Close link fd and cgroup fd */
> +	bpf_link__destroy(link);
> +	link = NULL;
> +	close(cgrp_fd);
> +	cgrp_fd = -1;

We can remove 'link = NULL' and 'cgroup_fd = -1' and
add 'return' after 'close(iter_fd)', which seems better
to understand the code.

> +
> +	/* Remove cgroup to mark it as dead */
> +	remove_cgroup(cgrp_name);
> +
> +	/* Two kern_sync_rcu() and usleep() pair are used to wait for the
> +	 * releases of cgroup css, and the last kern_sync_rcu() and usleep()
> +	 * pair is used to wait for the free of cgroup itself.
> +	 */
> +	kern_sync_rcu();
> +	usleep(8000);
> +	kern_sync_rcu();
> +	usleep(8000);
> +	kern_sync_rcu();
> +	usleep(1000);
> +
> +	memset(buf, 0, sizeof(buf));
> +	left = ARRAY_SIZE(buf);
> +	p = buf;
> +	while ((len = read(iter_fd, p, left)) > 0) {
> +		p += len;
> +		left -= len;
> +	}
> +
> +	ASSERT_STREQ(buf, expected_output, "dead cgroup output");
> +
> +	/* read() after iter finishes should be ok. */
> +	if (len == 0)
> +		ASSERT_OK(read(iter_fd, buf, sizeof(buf)), "second_read");
> +
> +	close(iter_fd);
> +free_link:
> +	bpf_link__destroy(link);
> +close_cg:
> +	if (cgrp_fd >= 0)
> +		close(cgrp_fd);
> +}
> +
>   void test_cgroup_iter(void)
>   {
>   	struct cgroup_iter *skel = NULL;
> @@ -217,6 +293,8 @@ void test_cgroup_iter(void)
>   		test_early_termination(skel);
>   	if (test__start_subtest("cgroup_iter__self_only"))
>   		test_walk_self_only(skel);
> +	if (test__start_subtest("cgroup_iter_dead_self_only"))

Let us follow the convention in this file with
	cgroup_iter__dead_self_only

> +		test_walk_dead_self_only(skel);
>   out:
>   	cgroup_iter__destroy(skel);
>   	cleanup_cgroups();
Hou Tao Nov. 8, 2022, 12:39 a.m. UTC | #2 
Hi,

On 11/8/2022 6:44 AM, Yonghong Song wrote:
>
>
> On 11/6/22 11:42 PM, Hou Tao wrote:
>> From: Hou Tao <houtao1@huawei.com>
>>
>> The test closes both iterator link fd and cgroup fd, and removes the
>> cgroup file to make a dead cgroup before reading cgroup iterator fd. It
>> also uses kern_sync_rcu() and usleep() to wait for the release of
>> start cgroup. If the start cgroup is not pinned by cgroup iterator,
>> reading iterator fd will trigger use-after-free.
>>
>> Signed-off-by: Hou Tao <houtao1@huawei.com>
>
> LGTM with a few nits below.
>
> Acked-by: Yonghong Song <yhs@fb.com>
SNIP
>
>> +    cgrp_fd = create_and_get_cgroup(cgrp_name);
>> +    if (!ASSERT_GE(cgrp_fd, 0, "create cgrp"))
>> +        return;
>> +
>> +    /* The cgroup is already dead during iteration, so it only has epilogue
>> +     * in the output.
>> +     */
>
> Let us reword the comment like
>     The cgroup will be dead during read() iteration, and it only has
>     epilogue in the output.
Will do in v2.
>
>> +    snprintf(expected_output, sizeof(expected_output), EPILOGUE);
>> +
>> +    memset(&linfo, 0, sizeof(linfo));
>> +    linfo.cgroup.cgroup_fd = cgrp_fd;
>> +    linfo.cgroup.order = BPF_CGROUP_ITER_SELF_ONLY;
>> +    opts.link_info = &linfo;
>> +    opts.link_info_len = sizeof(linfo);
>> +
SNIP
>>   void test_cgroup_iter(void)
>>   {
>>       struct cgroup_iter *skel = NULL;
>> @@ -217,6 +293,8 @@ void test_cgroup_iter(void)
>>           test_early_termination(skel);
>>       if (test__start_subtest("cgroup_iter__self_only"))
>>           test_walk_self_only(skel);
>> +    if (test__start_subtest("cgroup_iter_dead_self_only"))
>
> Let us follow the convention in this file with
>     cgroup_iter__dead_self_only
My bad. Will fixes in v2.
>
>> +        test_walk_dead_self_only(skel);
>>   out:
>>       cgroup_iter__destroy(skel);
>>       cleanup_cgroups();
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c b/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
index c4a2adb38da1..d64ed1cf1554 100644
--- a/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
+++ b/tools/testing/selftests/bpf/prog_tests/cgroup_iter.c
@@ -189,6 +189,82 @@  static void test_walk_self_only(struct cgroup_iter *skel)
 			      BPF_CGROUP_ITER_SELF_ONLY, "self_only");
 }
 
+static void test_walk_dead_self_only(struct cgroup_iter *skel)
+{
+	DECLARE_LIBBPF_OPTS(bpf_iter_attach_opts, opts);
+	char expected_output[128], buf[128];
+	const char *cgrp_name = "/dead";
+	union bpf_iter_link_info linfo;
+	int len, cgrp_fd, iter_fd;
+	struct bpf_link *link;
+	size_t left;
+	char *p;
+
+	cgrp_fd = create_and_get_cgroup(cgrp_name);
+	if (!ASSERT_GE(cgrp_fd, 0, "create cgrp"))
+		return;
+
+	/* The cgroup is already dead during iteration, so it only has epilogue
+	 * in the output.
+	 */
+	snprintf(expected_output, sizeof(expected_output), EPILOGUE);
+
+	memset(&linfo, 0, sizeof(linfo));
+	linfo.cgroup.cgroup_fd = cgrp_fd;
+	linfo.cgroup.order = BPF_CGROUP_ITER_SELF_ONLY;
+	opts.link_info = &linfo;
+	opts.link_info_len = sizeof(linfo);
+
+	link = bpf_program__attach_iter(skel->progs.cgroup_id_printer, &opts);
+	if (!ASSERT_OK_PTR(link, "attach_iter"))
+		goto close_cg;
+
+	iter_fd = bpf_iter_create(bpf_link__fd(link));
+	if (!ASSERT_GE(iter_fd, 0, "iter_create"))
+		goto free_link;
+
+	/* Close link fd and cgroup fd */
+	bpf_link__destroy(link);
+	link = NULL;
+	close(cgrp_fd);
+	cgrp_fd = -1;
+
+	/* Remove cgroup to mark it as dead */
+	remove_cgroup(cgrp_name);
+
+	/* Two kern_sync_rcu() and usleep() pair are used to wait for the
+	 * releases of cgroup css, and the last kern_sync_rcu() and usleep()
+	 * pair is used to wait for the free of cgroup itself.
+	 */
+	kern_sync_rcu();
+	usleep(8000);
+	kern_sync_rcu();
+	usleep(8000);
+	kern_sync_rcu();
+	usleep(1000);
+
+	memset(buf, 0, sizeof(buf));
+	left = ARRAY_SIZE(buf);
+	p = buf;
+	while ((len = read(iter_fd, p, left)) > 0) {
+		p += len;
+		left -= len;
+	}
+
+	ASSERT_STREQ(buf, expected_output, "dead cgroup output");
+
+	/* read() after iter finishes should be ok. */
+	if (len == 0)
+		ASSERT_OK(read(iter_fd, buf, sizeof(buf)), "second_read");
+
+	close(iter_fd);
+free_link:
+	bpf_link__destroy(link);
+close_cg:
+	if (cgrp_fd >= 0)
+		close(cgrp_fd);
+}
+
 void test_cgroup_iter(void)
 {
 	struct cgroup_iter *skel = NULL;
@@ -217,6 +293,8 @@  void test_cgroup_iter(void)
 		test_early_termination(skel);
 	if (test__start_subtest("cgroup_iter__self_only"))
 		test_walk_self_only(skel);
+	if (test__start_subtest("cgroup_iter_dead_self_only"))
+		test_walk_dead_self_only(skel);
 out:
 	cgroup_iter__destroy(skel);
 	cleanup_cgroups();