[bpf-next,v7,0/2] bpf: Fix tailcall infinite loop caused by freplace

Message

Leon Hwang Oct. 10, 2024, 3:38 p.m. UTC

Previously, I addressed a tailcall infinite loop issue related to
trampolines[0].

In this patchset, I resolve a similar issue where a tailcall infinite loop
can occur due to the combination of tailcalls and freplace programs. The
fix prevents adding extended programs to the prog_array map and blocks the
extension of a tail callee program with freplace.

Key changes:

1. If a program or its subprogram has been extended by an freplace program,
   it can no longer be updated to a prog_array map.
2. If a program has been added to a prog_array map, neither it nor its
   subprograms can be extended by an freplace program.

Changes:
v6 -> v7:
  * Address comments from Alexei:
    * Rewrite commit message more imperative and consice with AI.
    * Extend bpf_trampoline_link_prog() and bpf_trampoline_unlink_prog()
      to link and unlink target prog for freplace prog.
    * Use guard(mutex)(&tgt_prog->aux->ext_mutex) instead of
      mutex_lock()&mutex_unlock() pair.
  * Address comment from Eduard:
    * Remove misplaced "Reported-by" and "Closes" tags.

v5 -> v6:
  * Fix a build warning reported by kernel test robot.

v4 -> v5:
  * Move code of linking/unlinking target prog of freplace to trampoline.c.
  * Address comments from Alexei:
    * Change type of prog_array_member_cnt to u64.
    * Combine two patches to one.

v3 -> v4:
  * Address comments from Eduard:
    * Rename 'tail_callee_cnt' to 'prog_array_member_cnt'.
    * Add comment to 'prog_array_member_cnt'.
    * Use a mutex to protect 'is_extended' and 'prog_array_member_cnt'.

v2 -> v3:
  * Address comments from Alexei:
    * Stop hacking JIT.
    * Prevent the specific use case at attach/update time.

v1 -> v2:
  * Address comment from Eduard:
    * Explain why nop5 and xor/nop3 are swapped at prologue.
  * Address comment from Alexei:
    * Disallow attaching tail_call_reachable freplace prog to
      not-tail_call_reachable target in verifier.
  * Update "bpf, arm64: Fix tailcall infinite loop caused by freplace" with
    latest arm64 JIT code.

Links:
[0] https://lore.kernel.org/bpf/[e-mail]/

Leon Hwang (2):
  bpf: Prevent tailcall infinite loop caused by freplace
  selftests/bpf: Add test to verify tailcall and freplace restrictions

 include/linux/bpf.h                           | 17 +++-
 kernel/bpf/arraymap.c                         | 23 ++++-
 kernel/bpf/core.c                             |  1 +
 kernel/bpf/syscall.c                          |  7 +-
 kernel/bpf/trampoline.c                       | 37 +++++--
 .../selftests/bpf/prog_tests/tailcalls.c      | 98 ++++++++++++++++++-
 .../testing/selftests/bpf/progs/tc_bpf2bpf.c  |  5 +-
 7 files changed, 168 insertions(+), 20 deletions(-)