diff mbox series

[bpf-next,v4] bpf: Reject attaching fexit/fmod_ret to __noreturn functions

Message ID 20250317121735.86515-2-laoar.shao@gmail.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series [bpf-next,v4] bpf: Reject attaching fexit/fmod_ret to __noreturn functions | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR success PR summary
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / GCC BPF
bpf/vmtest-bpf-next-VM_Test-7 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-11 success Logs for aarch64-gcc / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / GCC BPF
bpf/vmtest-bpf-next-VM_Test-12 success Logs for aarch64-gcc / veristat-meta
bpf/vmtest-bpf-next-VM_Test-15 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-14 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-18 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-19 success Logs for s390x-gcc / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-21 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-20 success Logs for s390x-gcc / veristat-meta
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-22 success Logs for x86_64-gcc / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-32 success Logs for x86_64-gcc / veristat-meta / x86_64-gcc veristat_meta
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-31 success Logs for x86_64-gcc / veristat-kernel / x86_64-gcc veristat_kernel
bpf/vmtest-bpf-next-VM_Test-40 success Logs for x86_64-llvm-17 / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-39 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-44 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18-O2
bpf/vmtest-bpf-next-VM_Test-43 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-17 / veristat-meta
bpf/vmtest-bpf-next-VM_Test-49 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-45 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-51 success Logs for x86_64-llvm-18 / veristat-meta
bpf/vmtest-bpf-next-VM_Test-50 success Logs for x86_64-llvm-18 / veristat-kernel
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17-O2
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for bpf-next
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers success CCed 13 of 13 maintainers
netdev/build_clang success Errors and warnings before: 0 this patch: 0
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 10 this patch: 10
netdev/checkpatch warning WARNING: line length of 96 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-8 success Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-9 success Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-37 success Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-38 success Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-48 success Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / GCC BPF / GCC BPF
bpf/vmtest-bpf-next-VM_Test-47 success Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-46 success Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-17 success Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc

Commit Message

Yafang Shao March 17, 2025, 12:17 p.m. UTC 
If we attach fexit/fmod_ret to __noreturn functions, it will cause an
issue that the bpf trampoline image will be left over even if the bpf
link has been destroyed. Take attaching do_exit() with fexit for example.
The fexit works as follows,

  bpf_trampoline
  + __bpf_tramp_enter
    + percpu_ref_get(&tr->pcref);

  + call do_exit()

  + __bpf_tramp_exit
    + percpu_ref_put(&tr->pcref);

Since do_exit() never returns, the refcnt of the trampoline image is
never decremented, preventing it from being freed. That can be verified
with as follows,

  $ bpftool link show                                   <<<< nothing output
  $ grep "bpf_trampoline_[0-9]" /proc/kallsyms
  ffffffffc04cb000 t bpf_trampoline_6442526459    [bpf] <<<< leftover

In this patch, all functions annotated with __noreturn are rejected, except
for the following cases:
- Functions that result in a system reboot, such as panic,
  machine_real_restart and rust_begin_unwind
- Functions that are never executed by tasks, such as rest_init and
  cpu_startup_entry
- Functions implemented in assembly, such as rewind_stack_and_make_dead and
  xen_cpu_bringup_again, lack an associated BTF ID.

With this change, attaching fexit probes to functions like do_exit() will
be rejected.

$ ./fexit
libbpf: prog 'fexit': BPF program load failed: -EINVAL
libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
Attaching fexit/fmod_ret to __noreturn functions is rejected.

Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 kernel/bpf/verifier.c | 48 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

Comments

Alexei Starovoitov March 17, 2025, 8:20 p.m. UTC | #1 
On Mon, Mar 17, 2025 at 5:18 AM Yafang Shao <laoar.shao@gmail.com> wrote:
>
> If we attach fexit/fmod_ret to __noreturn functions, it will cause an
> issue that the bpf trampoline image will be left over even if the bpf
> link has been destroyed. Take attaching do_exit() with fexit for example.
> The fexit works as follows,
>
>   bpf_trampoline
>   + __bpf_tramp_enter
>     + percpu_ref_get(&tr->pcref);
>
>   + call do_exit()
>
>   + __bpf_tramp_exit
>     + percpu_ref_put(&tr->pcref);
>
> Since do_exit() never returns, the refcnt of the trampoline image is
> never decremented, preventing it from being freed. That can be verified
> with as follows,
>
>   $ bpftool link show                                   <<<< nothing output
>   $ grep "bpf_trampoline_[0-9]" /proc/kallsyms
>   ffffffffc04cb000 t bpf_trampoline_6442526459    [bpf] <<<< leftover
>
> In this patch, all functions annotated with __noreturn are rejected, except
> for the following cases:
> - Functions that result in a system reboot, such as panic,
>   machine_real_restart and rust_begin_unwind
> - Functions that are never executed by tasks, such as rest_init and
>   cpu_startup_entry
> - Functions implemented in assembly, such as rewind_stack_and_make_dead and
>   xen_cpu_bringup_again, lack an associated BTF ID.
>
> With this change, attaching fexit probes to functions like do_exit() will
> be rejected.
>
> $ ./fexit
> libbpf: prog 'fexit': BPF program load failed: -EINVAL
> libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
> Attaching fexit/fmod_ret to __noreturn functions is rejected.
>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> ---
>  kernel/bpf/verifier.c | 48 +++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 48 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 9971c03adfd5..b7d7d5c4989f 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -22841,6 +22841,49 @@ BTF_ID(func, __rcu_read_unlock)
>  #endif
>  BTF_SET_END(btf_id_deny)
>
> +/* fexit and fmod_ret can't be used to attach to __noreturn functions.
> + * Currently, we must manually list all __noreturn functions here. Once a more
> + * robust solution is implemented, this workaround can be removed.
> + */
> +BTF_SET_START(noreturn_deny)
> +#define NORETURN(fn) BTF_ID(func, fn)

no need for extra macro. Just use BTF_ID(...) below.

> +#ifdef CONFIG_IA32_EMULATION
> +NORETURN(__ia32_sys_exit)
> +NORETURN(__ia32_sys_exit_group)
> +#endif
> +#ifdef CONFIG_KUNIT
> +NORETURN(__kunit_abort)
> +NORETURN(kunit_try_catch_throw)
> +#endif
> +#ifdef CONFIG_MODULES
> +NORETURN(__module_put_and_kthread_exit)
> +#endif
> +#ifdef CONFIG_X86_64
> +NORETURN(__x64_sys_exit)
> +NORETURN(__x64_sys_exit_group)
> +#endif
> +#ifdef CONFIG_XEN_PV_SMP
> +NORETURN(cpu_bringup_and_idle)
> +#endif

it's called during bringup. bpf doesn't exist at that time.
Drop it.

> +NORETURN(do_exit)
> +NORETURN(do_group_exit)
> +#if defined(CONFIG_X86) && defined(CONFIG_SMP)
> +NORETURN(hlt_play_dead)
> +#endif

This one is similar to panic.
Drop it.

> +#ifdef CONFIG_HYPERV
> +NORETURN(hv_ghcb_terminate)
> +#endif

Also does 'hlt'.
Drop it.

> +NORETURN(kthread_complete_and_exit)
> +NORETURN(kthread_exit)
> +NORETURN(make_task_dead)
> +#ifdef CONFIG_AMD_MEM_ENCRYPT
> +NORETURN(sev_es_terminate)
> +NORETURN(snp_abort)

drop both for the same reason as above.

> +#endif
> +NORETURN(stop_this_cpu)

and this one as well.

Pls make sure to resend as series of 2 patches
otherwise bpf CI will complain.

pw-bot: cr
Yafang Shao March 18, 2025, 3:57 a.m. UTC | #2 
On Tue, Mar 18, 2025 at 4:20 AM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Mar 17, 2025 at 5:18 AM Yafang Shao <laoar.shao@gmail.com> wrote:
> >
> > If we attach fexit/fmod_ret to __noreturn functions, it will cause an
> > issue that the bpf trampoline image will be left over even if the bpf
> > link has been destroyed. Take attaching do_exit() with fexit for example.
> > The fexit works as follows,
> >
> >   bpf_trampoline
> >   + __bpf_tramp_enter
> >     + percpu_ref_get(&tr->pcref);
> >
> >   + call do_exit()
> >
> >   + __bpf_tramp_exit
> >     + percpu_ref_put(&tr->pcref);
> >
> > Since do_exit() never returns, the refcnt of the trampoline image is
> > never decremented, preventing it from being freed. That can be verified
> > with as follows,
> >
> >   $ bpftool link show                                   <<<< nothing output
> >   $ grep "bpf_trampoline_[0-9]" /proc/kallsyms
> >   ffffffffc04cb000 t bpf_trampoline_6442526459    [bpf] <<<< leftover
> >
> > In this patch, all functions annotated with __noreturn are rejected, except
> > for the following cases:
> > - Functions that result in a system reboot, such as panic,
> >   machine_real_restart and rust_begin_unwind
> > - Functions that are never executed by tasks, such as rest_init and
> >   cpu_startup_entry
> > - Functions implemented in assembly, such as rewind_stack_and_make_dead and
> >   xen_cpu_bringup_again, lack an associated BTF ID.
> >
> > With this change, attaching fexit probes to functions like do_exit() will
> > be rejected.
> >
> > $ ./fexit
> > libbpf: prog 'fexit': BPF program load failed: -EINVAL
> > libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
> > Attaching fexit/fmod_ret to __noreturn functions is rejected.
> >
> > Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> > ---
> >  kernel/bpf/verifier.c | 48 +++++++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 48 insertions(+)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 9971c03adfd5..b7d7d5c4989f 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -22841,6 +22841,49 @@ BTF_ID(func, __rcu_read_unlock)
> >  #endif
> >  BTF_SET_END(btf_id_deny)
> >
> > +/* fexit and fmod_ret can't be used to attach to __noreturn functions.
> > + * Currently, we must manually list all __noreturn functions here. Once a more
> > + * robust solution is implemented, this workaround can be removed.
> > + */
> > +BTF_SET_START(noreturn_deny)
> > +#define NORETURN(fn) BTF_ID(func, fn)
>
> no need for extra macro. Just use BTF_ID(...) below.
>
> > +#ifdef CONFIG_IA32_EMULATION
> > +NORETURN(__ia32_sys_exit)
> > +NORETURN(__ia32_sys_exit_group)
> > +#endif
> > +#ifdef CONFIG_KUNIT
> > +NORETURN(__kunit_abort)
> > +NORETURN(kunit_try_catch_throw)
> > +#endif
> > +#ifdef CONFIG_MODULES
> > +NORETURN(__module_put_and_kthread_exit)
> > +#endif
> > +#ifdef CONFIG_X86_64
> > +NORETURN(__x64_sys_exit)
> > +NORETURN(__x64_sys_exit_group)
> > +#endif
> > +#ifdef CONFIG_XEN_PV_SMP
> > +NORETURN(cpu_bringup_and_idle)
> > +#endif
>
> it's called during bringup. bpf doesn't exist at that time.
> Drop it.
>
> > +NORETURN(do_exit)
> > +NORETURN(do_group_exit)
> > +#if defined(CONFIG_X86) && defined(CONFIG_SMP)
> > +NORETURN(hlt_play_dead)
> > +#endif
>
> This one is similar to panic.
> Drop it.
>
> > +#ifdef CONFIG_HYPERV
> > +NORETURN(hv_ghcb_terminate)
> > +#endif
>
> Also does 'hlt'.
> Drop it.
>
> > +NORETURN(kthread_complete_and_exit)
> > +NORETURN(kthread_exit)
> > +NORETURN(make_task_dead)
> > +#ifdef CONFIG_AMD_MEM_ENCRYPT
> > +NORETURN(sev_es_terminate)
> > +NORETURN(snp_abort)
>
> drop both for the same reason as above.
>
> > +#endif
> > +NORETURN(stop_this_cpu)
>
> and this one as well.
>
> Pls make sure to resend as series of 2 patches
> otherwise bpf CI will complain.

will change it.
Thanks for your review.
diff mbox series

Patch

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9971c03adfd5..b7d7d5c4989f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -22841,6 +22841,49 @@  BTF_ID(func, __rcu_read_unlock)
 #endif
 BTF_SET_END(btf_id_deny)
 
+/* fexit and fmod_ret can't be used to attach to __noreturn functions.
+ * Currently, we must manually list all __noreturn functions here. Once a more
+ * robust solution is implemented, this workaround can be removed.
+ */
+BTF_SET_START(noreturn_deny)
+#define NORETURN(fn) BTF_ID(func, fn)
+#ifdef CONFIG_IA32_EMULATION
+NORETURN(__ia32_sys_exit)
+NORETURN(__ia32_sys_exit_group)
+#endif
+#ifdef CONFIG_KUNIT
+NORETURN(__kunit_abort)
+NORETURN(kunit_try_catch_throw)
+#endif
+#ifdef CONFIG_MODULES
+NORETURN(__module_put_and_kthread_exit)
+#endif
+#ifdef CONFIG_X86_64
+NORETURN(__x64_sys_exit)
+NORETURN(__x64_sys_exit_group)
+#endif
+#ifdef CONFIG_XEN_PV_SMP
+NORETURN(cpu_bringup_and_idle)
+#endif
+NORETURN(do_exit)
+NORETURN(do_group_exit)
+#if defined(CONFIG_X86) && defined(CONFIG_SMP)
+NORETURN(hlt_play_dead)
+#endif
+#ifdef CONFIG_HYPERV
+NORETURN(hv_ghcb_terminate)
+#endif
+NORETURN(kthread_complete_and_exit)
+NORETURN(kthread_exit)
+NORETURN(make_task_dead)
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+NORETURN(sev_es_terminate)
+NORETURN(snp_abort)
+#endif
+NORETURN(stop_this_cpu)
+#undef NORETURN
+BTF_SET_END(noreturn_deny)
+
 static bool can_be_sleepable(struct bpf_prog *prog)
 {
 	if (prog->type == BPF_PROG_TYPE_TRACING) {
@@ -22929,6 +22972,11 @@  static int check_attach_btf_id(struct bpf_verifier_env *env)
 	} else if (prog->type == BPF_PROG_TYPE_TRACING &&
 		   btf_id_set_contains(&btf_id_deny, btf_id)) {
 		return -EINVAL;
+	} else if ((prog->expected_attach_type == BPF_TRACE_FEXIT ||
+		   prog->expected_attach_type == BPF_MODIFY_RETURN) &&
+		   btf_id_set_contains(&noreturn_deny, btf_id)) {
+		verbose(env, "Attaching fexit/fmod_ret to __noreturn functions is rejected.\n");
+		return -EINVAL;
 	}
 
 	key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id);