@@ -3196,7 +3196,9 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
goto out_unlock;
}
btf_id = prog->aux->attach_btf_id;
- key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id);
+ if (prog->aux->attach_btf)
+ key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf,
+ btf_id);
}
if (!prog->aux->dst_trampoline ||
@@ -83,3 +83,51 @@ void test_recursive_fentry_attach(void)
fentry_recursive__destroy(tracing_chain[i]);
}
}
+
+/*
+ * Test that a tracing prog reattachment (when we land in
+ * "prog->aux->dst_trampoline and tgt_prog is NULL" branch in
+ * bpf_tracing_prog_attach) does not lead to a crash due to missing attach_btf
+ */
+void test_fentry_attach_btf_presence(void)
+{
+ struct fentry_recursive_target *target_skel = NULL;
+ struct fentry_recursive *tracing_skel = NULL;
+ struct bpf_program *prog;
+ int err, link_fd, tgt_prog_fd;
+
+ target_skel = fentry_recursive_target__open_and_load();
+ if (!ASSERT_OK_PTR(target_skel, "fentry_recursive_target__open_and_load"))
+ goto close_prog;
+
+ tracing_skel = fentry_recursive__open();
+ if (!ASSERT_OK_PTR(tracing_skel, "fentry_recursive__open"))
+ goto close_prog;
+
+ prog = tracing_skel->progs.recursive_attach;
+ tgt_prog_fd = bpf_program__fd(target_skel->progs.fentry_target);
+ err = bpf_program__set_attach_target(prog, tgt_prog_fd, "fentry_target");
+ if (!ASSERT_OK(err, "bpf_program__set_attach_target"))
+ goto close_prog;
+
+ err = fentry_recursive__load(tracing_skel);
+ if (!ASSERT_OK(err, "fentry_recursive__load"))
+ goto close_prog;
+
+ LIBBPF_OPTS(bpf_link_create_opts, link_opts);
+
+ link_fd = bpf_link_create(bpf_program__fd(tracing_skel->progs.recursive_attach),
+ 0, BPF_TRACE_FENTRY, &link_opts);
+ if (!ASSERT_GE(link_fd, 0, "link_fd"))
+ goto close_prog;
+
+ fentry_recursive__detach(tracing_skel);
+
+ err = fentry_recursive__attach(tracing_skel);
+ if (!ASSERT_ERR(err, "fentry_recursive__attach"))
+ goto close_prog;
+
+close_prog:
+ fentry_recursive_target__destroy(target_skel);
+ fentry_recursive__destroy(tracing_skel);
+}
@@ -18,3 +18,14 @@ int BPF_PROG(test1, int a)
test1_result = a == 1;
return 0;
}
+
+/*
+ * Dummy bpf prog for testing attach_btf presence when attaching an fentry
+ * program.
+ */
+SEC("raw_tp/sys_enter")
+int BPF_PROG(fentry_target, struct pt_regs *regs, long id)
+{
+ test1_result = id == 1;
+ return 0;
+}
It looks like there is an issue in bpf_tracing_prog_attach, in the "prog->aux->dst_trampoline and tgt_prog is NULL" case. One can construct a sequence of events when prog->aux->attach_btf will be NULL, and bpf_trampoline_compute_key will fail. BUG: kernel NULL pointer dereference, address: 0000000000000058 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x15b/0x430 ? fixup_exception+0x22/0x330 ? exc_page_fault+0x6f/0x170 ? asm_exc_page_fault+0x22/0x30 ? bpf_tracing_prog_attach+0x279/0x560 ? btf_obj_id+0x5/0x10 bpf_tracing_prog_attach+0x439/0x560 __sys_bpf+0x1cf4/0x2de0 __x64_sys_bpf+0x1c/0x30 do_syscall_64+0x41/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 The issue seems to be not relevant to the previous changes with recursive tracing prog attach, because the reproducing test doesn't actually include recursive fentry attaching. Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com> --- kernel/bpf/syscall.c | 4 +- .../bpf/prog_tests/recursive_attach.c | 48 +++++++++++++++++++ .../bpf/progs/fentry_recursive_target.c | 11 +++++ 3 files changed, 62 insertions(+), 1 deletion(-)