diff mbox series

[bpf,2/2] selftests/bpf: Test race between map uref release and bpf timer init

Message ID 20231017125717.241101-3-houtao@huaweicloud.com (mailing list archive)
State Superseded
Delegated to: BPF
Headers show
Series bpf: Fix bpf timer kmemleak | expand

Checks

Context Check Description
bpf/vmtest-bpf-VM_Test-0 success Logs for ShellCheck
bpf/vmtest-bpf-PR success PR summary
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for bpf, async
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 9 this patch: 9
netdev/cc_maintainers warning 3 maintainers not CCed: shuah@kernel.org mykolal@fb.com linux-kselftest@vger.kernel.org
netdev/build_clang success Errors and warnings before: 9 this patch: 9
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 9 this patch: 9
netdev/checkpatch warning WARNING: Use of volatile is usually wrong: see Documentation/process/volatile-considered-harmful.rst WARNING: added, moved or deleted file(s), does MAINTAINERS need updating? WARNING: line length of 90 exceeds 80 columns WARNING: line length of 97 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-VM_Test-3 success Logs for build for x86_64 with gcc
bpf/vmtest-bpf-VM_Test-4 success Logs for build for x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-6 success Logs for test_maps on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-5 success Logs for set-matrix
bpf/vmtest-bpf-VM_Test-1 success Logs for build for aarch64 with gcc
bpf/vmtest-bpf-VM_Test-2 success Logs for build for s390x with gcc
bpf/vmtest-bpf-VM_Test-7 success Logs for test_maps on s390x with gcc
bpf/vmtest-bpf-VM_Test-9 success Logs for test_maps on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-8 success Logs for test_maps on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-10 success Logs for test_progs on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-11 success Logs for test_progs on s390x with gcc
bpf/vmtest-bpf-VM_Test-12 success Logs for test_progs on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-13 success Logs for test_progs on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-23 success Logs for test_progs_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-24 success Logs for test_verifier on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-16 success Logs for test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-28 success Logs for veristat
bpf/vmtest-bpf-VM_Test-26 success Logs for test_verifier on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-22 success Logs for test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-27 success Logs for test_verifier on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-19 success Logs for test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-VM_Test-14 success Logs for test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-15 success Logs for test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-VM_Test-25 success Logs for test_verifier on s390x with gcc
bpf/vmtest-bpf-VM_Test-20 success Logs for test_progs_no_alu32_parallel on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-17 success Logs for test_progs_no_alu32 on x86_64 with llvm-16
bpf/vmtest-bpf-VM_Test-21 success Logs for test_progs_parallel on aarch64 with gcc
bpf/vmtest-bpf-VM_Test-18 success Logs for test_progs_no_alu32_parallel on aarch64 with gcc

Commit Message

Hou Tao Oct. 17, 2023, 12:57 p.m. UTC
From: Hou Tao <houtao1@huawei.com>

Test race between the release of map ref and bpf_timer_init():
1) create one thread to add array map with bpf_timer into array of
   arrays map repeatedly.
2) create another thread to call getpgid() and call bpf_timer_init()
   in the attached bpf program repeatedly.
3) synchronize these two threads through pthread barrier.

It is a bit hard to trigger the kmemleak by only running the test. I
managed to reproduce the kmemleak by injecting a delay between
t->timer.function = bpf_timer_cb and timer->timer = t in
bpf_timer_init().

The following is the output of kmemleak after reproducing:

unreferenced object 0xffff8881163d3780 (size 96):
  comm "test_progs", pid 539, jiffies 4295358164 (age 23.276s)
  hex dump (first 32 bytes):
    80 37 3d 16 81 88 ff ff 00 00 00 00 00 00 00 00  .7=.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000bbc3f059>] __kmem_cache_alloc_node+0x3b1/0x4a0
    [<00000000a24ddf4d>] __kmalloc_node+0x57/0x140
    [<000000004d577dbf>] bpf_map_kmalloc_node+0x5f/0x180
    [<00000000bd8428d3>] bpf_timer_init+0xf6/0x1b0
    [<0000000086d87323>] 0xffffffffc000c94e
    [<000000005a09e655>] trace_call_bpf+0xc5/0x1c0
    [<0000000051ab837b>] kprobe_perf_func+0x51/0x260
    [<000000000069bbd1>] kprobe_dispatcher+0x61/0x70
    [<000000007dceb75b>] kprobe_ftrace_handler+0x168/0x240
    [<00000000d8721bd7>] 0xffffffffc02010f7
    [<00000000e885b809>] __x64_sys_getpgid+0x1/0x20
    [<000000007be835d8>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Signed-off-by: Hou Tao <houtao1@huawei.com>
---
 .../bpf/prog_tests/timer_init_race.c          | 138 ++++++++++++++++++
 .../selftests/bpf/progs/timer_init_race.c     |  56 +++++++
 2 files changed, 194 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/timer_init_race.c
 create mode 100644 tools/testing/selftests/bpf/progs/timer_init_race.c
diff mbox series

Patch

diff --git a/tools/testing/selftests/bpf/prog_tests/timer_init_race.c b/tools/testing/selftests/bpf/prog_tests/timer_init_race.c
new file mode 100644
index 000000000000..7bd57459e504
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/timer_init_race.c
@@ -0,0 +1,138 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2023. Huawei Technologies Co., Ltd */
+#define _GNU_SOURCE
+#include <unistd.h>
+#include <sys/syscall.h>
+#include <test_progs.h>
+#include <bpf/btf.h>
+#include "timer_init_race.skel.h"
+
+struct thread_ctx {
+	struct bpf_map_create_opts opts;
+	pthread_barrier_t barrier;
+	int outer_map_fd;
+	int start, abort;
+	int loop, err;
+};
+
+static int wait_for_start_or_abort(struct thread_ctx *ctx)
+{
+	while (!ctx->start && !ctx->abort)
+		usleep(1);
+	return ctx->abort ? -1 : 0;
+}
+
+static void *close_map_fn(void *data)
+{
+	struct thread_ctx *ctx = data;
+	int loop = ctx->loop, err = 0;
+
+	if (wait_for_start_or_abort(ctx) < 0)
+		return NULL;
+
+	while (loop-- > 0) {
+		int fd, zero = 0, i;
+		volatile int s = 0;
+
+		fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, 4, sizeof(struct bpf_timer),
+				    1, &ctx->opts);
+		if (fd < 0) {
+			err |= 1;
+			pthread_barrier_wait(&ctx->barrier);
+			continue;
+		}
+
+		if (bpf_map_update_elem(ctx->outer_map_fd, &zero, &fd, 0) < 0)
+			err |= 2;
+
+		pthread_barrier_wait(&ctx->barrier);
+		/* let bpf_timer_init run first */
+		for (i = 0; i < 5000; i++)
+			s++;
+		close(fd);
+	}
+
+	ctx->err = err;
+
+	return NULL;
+}
+
+static void *init_timer_fn(void *data)
+{
+	struct thread_ctx *ctx = data;
+	int loop = ctx->loop;
+
+	if (wait_for_start_or_abort(ctx) < 0)
+		return NULL;
+
+	while (loop-- > 0) {
+		pthread_barrier_wait(&ctx->barrier);
+		syscall(SYS_getpgid);
+	}
+
+	return NULL;
+}
+
+void test_timer_init_race(void)
+{
+	struct timer_init_race *skel;
+	struct thread_ctx ctx;
+	pthread_t tid[2];
+	struct btf *btf;
+	int err;
+
+	skel = timer_init_race__open();
+	if (!ASSERT_OK_PTR(skel, "timer_init_race open"))
+		return;
+
+	err = timer_init_race__load(skel);
+	if (!ASSERT_EQ(err, 0, "timer_init_race load"))
+		goto out;
+
+	memset(&ctx, 0, sizeof(ctx));
+
+	btf = bpf_object__btf(skel->obj);
+	if (!ASSERT_OK_PTR(btf, "timer_init_race btf"))
+		goto out;
+
+	LIBBPF_OPTS_RESET(ctx.opts);
+	ctx.opts.btf_fd = bpf_object__btf_fd(skel->obj);
+	if (!ASSERT_GE((int)ctx.opts.btf_fd, 0, "btf_fd"))
+		goto out;
+	ctx.opts.btf_key_type_id = btf__find_by_name(btf, "int");
+	if (!ASSERT_GT(ctx.opts.btf_key_type_id, 0, "key_type_id"))
+		goto out;
+	ctx.opts.btf_value_type_id = btf__find_by_name_kind(btf, "inner_value", BTF_KIND_STRUCT);
+	if (!ASSERT_GT(ctx.opts.btf_value_type_id, 0, "value_type_id"))
+		goto out;
+
+	err = timer_init_race__attach(skel);
+	if (!ASSERT_EQ(err, 0, "timer_init_race attach"))
+		goto out;
+
+	skel->bss->tgid = getpid();
+
+	pthread_barrier_init(&ctx.barrier, NULL, 2);
+	ctx.outer_map_fd = bpf_map__fd(skel->maps.outer_map);
+	ctx.loop = 8;
+
+	err = pthread_create(&tid[0], NULL, close_map_fn, &ctx);
+	if (!ASSERT_OK(err, "close_thread"))
+		goto out;
+
+	err = pthread_create(&tid[1], NULL, init_timer_fn, &ctx);
+	if (!ASSERT_OK(err, "init_thread")) {
+		ctx.abort = 1;
+		pthread_join(tid[0], NULL);
+		goto out;
+	}
+
+	ctx.start = 1;
+	pthread_join(tid[0], NULL);
+	pthread_join(tid[1], NULL);
+
+	ASSERT_EQ(ctx.err, 0, "error");
+	ASSERT_EQ(skel->bss->cnt, 8, "cnt");
+out:
+	timer_init_race__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/timer_init_race.c b/tools/testing/selftests/bpf/progs/timer_init_race.c
new file mode 100644
index 000000000000..ba67cb178639
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/timer_init_race.c
@@ -0,0 +1,56 @@ 
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (C) 2023. Huawei Technologies Co., Ltd */
+#include <linux/bpf.h>
+#include <time.h>
+#include <bpf/bpf_helpers.h>
+
+#include "bpf_misc.h"
+
+struct inner_value {
+	struct bpf_timer timer;
+};
+
+struct inner_map_type {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__type(key, int);
+	__type(value, struct inner_value);
+	__uint(max_entries, 1);
+} inner_map SEC(".maps");
+
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
+	__type(key, int);
+	__type(value, int);
+	__uint(max_entries, 1);
+	__array(values, struct inner_map_type);
+} outer_map SEC(".maps") = {
+	.values = {
+		[0] = &inner_map,
+	},
+};
+
+char _license[] SEC("license") = "GPL";
+
+int tgid = 0, cnt = 0;
+
+SEC("kprobe/" SYS_PREFIX "sys_getpgid")
+int do_timer_init(void *ctx)
+{
+	struct inner_map_type *map;
+	struct inner_value *value;
+	int zero = 0;
+
+	if ((bpf_get_current_pid_tgid() >> 32) != tgid)
+		return 0;
+
+	map = bpf_map_lookup_elem(&outer_map, &zero);
+	if (!map)
+		return 0;
+	value = bpf_map_lookup_elem(map, &zero);
+	if (!value)
+		return 0;
+	bpf_timer_init(&value->timer, map, CLOCK_MONOTONIC);
+	cnt++;
+
+	return 0;
+}