From patchwork Mon Jul 11 08:32:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Artem Savkov X-Patchwork-Id: 12913113 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 329D2C43334 for ; Mon, 11 Jul 2022 08:32:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230149AbiGKIcb (ORCPT ); Mon, 11 Jul 2022 04:32:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230147AbiGKIc1 (ORCPT ); Mon, 11 Jul 2022 04:32:27 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 5808C1F2EE for ; Mon, 11 Jul 2022 01:32:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1657528345; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=M0PhMaVhgVmMUL6iKuE1xZ83zlO0I8KTf8X7DkJEHvo=; b=ZhMq6Rst1KsZoQ9tQKDkhobaZgN9f/xluz5h/gd5MuPEZRZH3fSBIgztvcofY4o271lCDY B6SPPYhJXMYmWvowvds6oBZoi4nApSlnCAnBQEPAf6iS+PMGKpB6j0QtD4kHzek3bs85/v 5XlZ3sEKJp6g+0xA605uWOwIrYv1yjg= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-267-8gpMUgCwOzeGFlvL8H0TJw-1; Mon, 11 Jul 2022 04:32:23 -0400 X-MC-Unique: 8gpMUgCwOzeGFlvL8H0TJw-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 2F86880418F; Mon, 11 Jul 2022 08:32:23 +0000 (UTC) Received: from shodan.usersys.redhat.com (unknown [10.43.17.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 09AFF141511A; Mon, 11 Jul 2022 08:32:22 +0000 (UTC) Received: by shodan.usersys.redhat.com (Postfix, from userid 1000) id E7A1D1C0151; Mon, 11 Jul 2022 10:32:21 +0200 (CEST) From: Artem Savkov To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , bpf@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Andrea Arcangeli , Artem Savkov Subject: [RFC PATCH bpf-next 1/4] bpf: add a sysctl to enable destructive bpf helpers Date: Mon, 11 Jul 2022 10:32:17 +0200 Message-Id: <20220711083220.2175036-2-asavkov@redhat.com> In-Reply-To: <20220711083220.2175036-1-asavkov@redhat.com> References: <20220711083220.2175036-1-asavkov@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.85 on 10.11.54.7 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net X-Patchwork-State: RFC Add a kernel.destructive_bpf_enabled sysctl knob to allow enabling bpf helpers that can be destructive to the system. One such helper, bpf_panic(), is added later in the series. Signed-off-by: Artem Savkov --- include/linux/bpf.h | 6 ++++++ kernel/bpf/syscall.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 0edd7d2c0064..77972724bed7 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1641,6 +1641,7 @@ bpf_map_alloc_percpu(const struct bpf_map *map, size_t size, size_t align, #endif extern int sysctl_unprivileged_bpf_disabled; +extern int sysctl_destructive_bpf_enabled; static inline bool bpf_allow_ptr_leaks(void) { @@ -1926,6 +1927,11 @@ static inline bool unprivileged_ebpf_enabled(void) return !sysctl_unprivileged_bpf_disabled; } +static inline bool destructive_ebpf_enabled(void) +{ + return sysctl_destructive_bpf_enabled; +} + #else /* !CONFIG_BPF_SYSCALL */ static inline struct bpf_prog *bpf_prog_get(u32 ufd) { diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 7d5af5b99f0d..1ce6541d90e1 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -57,6 +57,8 @@ static DEFINE_SPINLOCK(link_idr_lock); int sysctl_unprivileged_bpf_disabled __read_mostly = IS_BUILTIN(CONFIG_BPF_UNPRIV_DEFAULT_OFF) ? 2 : 0; +int sysctl_destructive_bpf_enabled __read_mostly = 0; + static const struct bpf_map_ops * const bpf_map_types[] = { #define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) #define BPF_MAP_TYPE(_id, _ops) \ @@ -5226,6 +5228,24 @@ static int bpf_unpriv_handler(struct ctl_table *table, int write, return ret; } +static int bpf_destructive_handler(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos) +{ + int ret, destructive_enable = *(int *)table->data; + struct ctl_table tmp = *table; + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + tmp.data = &destructive_enable; + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); + if (write && !ret) { + *(int *)table->data = destructive_enable; + } + + return ret; +} + static struct ctl_table bpf_syscall_table[] = { { .procname = "unprivileged_bpf_disabled", @@ -5236,6 +5256,15 @@ static struct ctl_table bpf_syscall_table[] = { .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_TWO, }, + { + .procname = "destructive_bpf_enabled", + .data = &sysctl_destructive_bpf_enabled, + .maxlen = sizeof(sysctl_destructive_bpf_enabled), + .mode = 0644, + .proc_handler = bpf_destructive_handler, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, + }, { .procname = "bpf_stats_enabled", .data = &bpf_stats_enabled_key.key, From patchwork Mon Jul 11 08:32:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Artem Savkov X-Patchwork-Id: 12913116 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C2EEC43334 for ; Mon, 11 Jul 2022 08:33:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230199AbiGKIdC (ORCPT ); Mon, 11 Jul 2022 04:33:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230200AbiGKIcf (ORCPT ); Mon, 11 Jul 2022 04:32:35 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id ADAD61FCC0 for ; Mon, 11 Jul 2022 01:32:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1657528352; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=YEy+JbF4/MHQmoWPD6TNS3XHUSO00yIucme0xMgXZWk=; b=CJLpXYhHCJWmCVJL6n+rVaFQ/Vo0kBYIn8YpGRhXn4SYi3Z9dgiB2dlHlfQYncDJGAE9eg Rnk0/UHKYWNm/iuPwq7+g1T1MYmZzvELCeZdslX1P2zTlg7EXAUmovgP6+oHGxhMFrbjsA FtQwW7scJ4my2jX8VH3bVmd4hG2/Jaw= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-584-C_R0PKqGPtiBMFNB8fnwxA-1; Mon, 11 Jul 2022 04:32:23 -0400 X-MC-Unique: C_R0PKqGPtiBMFNB8fnwxA-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 3097C80029D; Mon, 11 Jul 2022 08:32:23 +0000 (UTC) Received: from shodan.usersys.redhat.com (unknown [10.43.17.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 097E01121314; Mon, 11 Jul 2022 08:32:22 +0000 (UTC) Received: by shodan.usersys.redhat.com (Postfix, from userid 1000) id F1F241C0258; Mon, 11 Jul 2022 10:32:21 +0200 (CEST) From: Artem Savkov To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , bpf@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Andrea Arcangeli , Artem Savkov Subject: [RFC PATCH bpf-next 2/4] bpf: add BPF_F_DESTRUCTIVE flag for BPF_PROG_LOAD Date: Mon, 11 Jul 2022 10:32:18 +0200 Message-Id: <20220711083220.2175036-3-asavkov@redhat.com> In-Reply-To: <20220711083220.2175036-1-asavkov@redhat.com> References: <20220711083220.2175036-1-asavkov@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net X-Patchwork-State: RFC Add a BPF_F_DESTRUCTIVE will be required to be supplied to BPF_PROG_LOAD for programs to utilize destructive helpers such as bpf_panic(). Signed-off-by: Artem Savkov --- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 6 ++++++ kernel/bpf/syscall.c | 4 +++- tools/include/uapi/linux/bpf.h | 6 ++++++ 4 files changed, 16 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 77972724bed7..43c008e3587a 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1041,6 +1041,7 @@ struct bpf_prog_aux { bool sleepable; bool tail_call_reachable; bool xdp_has_frags; + bool destructive; bool use_bpf_prog_pack; /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ const struct btf_type *attach_func_proto; diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index e81362891596..4423874b5da4 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -1121,6 +1121,12 @@ enum bpf_link_type { */ #define BPF_F_XDP_HAS_FRAGS (1U << 5) +/* If BPF_F_DESTRUCTIVE is used in BPF_PROG_LOAD command, the loaded program + * will be able to perform destructive operations such as calling bpf_panic() + * helper. + */ +#define BPF_F_DESTRUCTIVE (1U << 6) + /* link_create.kprobe_multi.flags used in LINK_CREATE command for * BPF_TRACE_KPROBE_MULTI attach type to create return probe. */ diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 1ce6541d90e1..779feac2dc7d 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2449,7 +2449,8 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr) BPF_F_TEST_STATE_FREQ | BPF_F_SLEEPABLE | BPF_F_TEST_RND_HI32 | - BPF_F_XDP_HAS_FRAGS)) + BPF_F_XDP_HAS_FRAGS | + BPF_F_DESTRUCTIVE)) return -EINVAL; if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && @@ -2536,6 +2537,7 @@ static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr) prog->aux->offload_requested = !!attr->prog_ifindex; prog->aux->sleepable = attr->prog_flags & BPF_F_SLEEPABLE; prog->aux->xdp_has_frags = attr->prog_flags & BPF_F_XDP_HAS_FRAGS; + prog->aux->destructive = attr->prog_flags & BPF_F_DESTRUCTIVE; err = security_bpf_prog_alloc(prog->aux); if (err) diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index e81362891596..4423874b5da4 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -1121,6 +1121,12 @@ enum bpf_link_type { */ #define BPF_F_XDP_HAS_FRAGS (1U << 5) +/* If BPF_F_DESTRUCTIVE is used in BPF_PROG_LOAD command, the loaded program + * will be able to perform destructive operations such as calling bpf_panic() + * helper. + */ +#define BPF_F_DESTRUCTIVE (1U << 6) + /* link_create.kprobe_multi.flags used in LINK_CREATE command for * BPF_TRACE_KPROBE_MULTI attach type to create return probe. */ From patchwork Mon Jul 11 08:32:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Artem Savkov X-Patchwork-Id: 12913115 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32BD7C43334 for ; Mon, 11 Jul 2022 08:32:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230246AbiGKIcs (ORCPT ); Mon, 11 Jul 2022 04:32:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230147AbiGKIcb (ORCPT ); Mon, 11 Jul 2022 04:32:31 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id A59DC1F630 for ; Mon, 11 Jul 2022 01:32:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1657528348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JjYLBUMSftH7/Ewb1QZ49Vc0Exdm+flUGINBW+1YvW0=; b=R9VXMZQZxbvx9qCcv8cwKgmPRPJCNwpOmdE/nl70gZurdtgIn6Pif/tiCnGRy1tLll8Wop o3UQnllDVLnyLD9SC1Z4gFiw6kJPyyjlm/HKGBxUT3hoSiWyljscouK+aHzIlZ7Ahi7DvD Zbmts1dy4rvXFXfbfsncqI5HhKmqxh4= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-399-m3OBsIK6PtyXp0jhmv-5iQ-1; Mon, 11 Jul 2022 04:32:23 -0400 X-MC-Unique: m3OBsIK6PtyXp0jhmv-5iQ-1 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4BCD8185A79C; Mon, 11 Jul 2022 08:32:23 +0000 (UTC) Received: from shodan.usersys.redhat.com (unknown [10.43.17.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 096F440CF8EA; Mon, 11 Jul 2022 08:32:22 +0000 (UTC) Received: by shodan.usersys.redhat.com (Postfix, from userid 1000) id 020A51C02A5; Mon, 11 Jul 2022 10:32:22 +0200 (CEST) From: Artem Savkov To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , bpf@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Andrea Arcangeli , Artem Savkov Subject: [RFC PATCH bpf-next 3/4] bpf: add bpf_panic() helper Date: Mon, 11 Jul 2022 10:32:19 +0200 Message-Id: <20220711083220.2175036-4-asavkov@redhat.com> In-Reply-To: <20220711083220.2175036-1-asavkov@redhat.com> References: <20220711083220.2175036-1-asavkov@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net X-Patchwork-State: RFC Add a helper that will make the kernel panic immediately with specified message. Using this helper requires kernel.destructive_bpf_enabled sysctl to be enabled, BPF_F_DESTRUCTIVE flag to be supplied on program load as well as CAP_SYS_BOOT capabilities. Signed-off-by: Artem Savkov --- include/linux/bpf.h | 1 + include/uapi/linux/bpf.h | 7 +++++++ kernel/bpf/core.c | 1 + kernel/bpf/helpers.c | 13 +++++++++++++ kernel/bpf/verifier.c | 7 +++++++ kernel/trace/bpf_trace.c | 2 ++ tools/include/uapi/linux/bpf.h | 7 +++++++ 7 files changed, 38 insertions(+) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 43c008e3587a..77c20ba9ca8e 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -2339,6 +2339,7 @@ extern const struct bpf_func_proto bpf_strtol_proto; extern const struct bpf_func_proto bpf_strtoul_proto; extern const struct bpf_func_proto bpf_tcp_sock_proto; extern const struct bpf_func_proto bpf_jiffies64_proto; +extern const struct bpf_func_proto bpf_panic_proto; extern const struct bpf_func_proto bpf_get_ns_current_pid_tgid_proto; extern const struct bpf_func_proto bpf_event_output_data_proto; extern const struct bpf_func_proto bpf_ringbuf_output_proto; diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index 4423874b5da4..e2e2c4de44ee 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3927,6 +3927,12 @@ union bpf_attr { * Return * The 64 bit jiffies * + * void bpf_panic(const char *msg) + * Description + * Make the kernel panic immediately + * Return + * void + * * long bpf_read_branch_records(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 flags) * Description * For an eBPF program attached to a perf event, retrieve the @@ -5452,6 +5458,7 @@ union bpf_attr { FN(tcp_send_ack), \ FN(send_signal_thread), \ FN(jiffies64), \ + FN(panic), \ FN(read_branch_records), \ FN(get_ns_current_pid_tgid), \ FN(xdp_output), \ diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index b5ffebcce6cc..0f333a0e85a5 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2649,6 +2649,7 @@ const struct bpf_func_proto bpf_map_lookup_percpu_elem_proto __weak; const struct bpf_func_proto bpf_spin_lock_proto __weak; const struct bpf_func_proto bpf_spin_unlock_proto __weak; const struct bpf_func_proto bpf_jiffies64_proto __weak; +const struct bpf_func_proto bpf_panic_proto __weak; const struct bpf_func_proto bpf_get_prandom_u32_proto __weak; const struct bpf_func_proto bpf_get_smp_processor_id_proto __weak; diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index a1c84d256f83..5cb90208a264 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -374,6 +374,19 @@ const struct bpf_func_proto bpf_jiffies64_proto = { .ret_type = RET_INTEGER, }; +BPF_CALL_1(bpf_panic, const char *, msg) +{ + panic(msg); + return 0; +} + +const struct bpf_func_proto bpf_panic_proto = { + .func = bpf_panic, + .gpl_only = false, + .ret_type = RET_VOID, + .arg1_type = ARG_PTR_TO_CONST_STR, +}; + #ifdef CONFIG_CGROUPS BPF_CALL_0(bpf_get_current_cgroup_id) { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 2859901ffbe3..f49c026917c5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7285,6 +7285,13 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn reg_type_str(env, regs[BPF_REG_1].type)); return -EACCES; } + break; + case BPF_FUNC_panic: + struct bpf_prog_aux *aux = env->prog->aux; + if (!aux->destructive) { + verbose(env, "bpf_panic() calls require BPF_F_DESTRUCTIVE flag\n"); + return -EACCES; + } } if (err) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 4be976cf7d63..3ee888507795 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -1304,6 +1304,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_find_vma_proto; case BPF_FUNC_trace_vprintk: return bpf_get_trace_vprintk_proto(); + case BPF_FUNC_panic: + return capable(CAP_SYS_BOOT) && destructive_ebpf_enabled() ? &bpf_panic_proto : NULL; default: return bpf_base_func_proto(func_id); } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 4423874b5da4..e2e2c4de44ee 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3927,6 +3927,12 @@ union bpf_attr { * Return * The 64 bit jiffies * + * void bpf_panic(const char *msg) + * Description + * Make the kernel panic immediately + * Return + * void + * * long bpf_read_branch_records(struct bpf_perf_event_data *ctx, void *buf, u32 size, u64 flags) * Description * For an eBPF program attached to a perf event, retrieve the @@ -5452,6 +5458,7 @@ union bpf_attr { FN(tcp_send_ack), \ FN(send_signal_thread), \ FN(jiffies64), \ + FN(panic), \ FN(read_branch_records), \ FN(get_ns_current_pid_tgid), \ FN(xdp_output), \ From patchwork Mon Jul 11 08:32:20 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Artem Savkov X-Patchwork-Id: 12913114 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7972EC43334 for ; Mon, 11 Jul 2022 08:32:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230182AbiGKIcc (ORCPT ); Mon, 11 Jul 2022 04:32:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230148AbiGKIc1 (ORCPT ); Mon, 11 Jul 2022 04:32:27 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 78E6B1F2FA for ; Mon, 11 Jul 2022 01:32:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1657528345; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rOvdknNIUIgwtUuGLKnWKb2uga4ygZMa7e3xZ51+vSU=; b=DMKzNf0jQjQWU2IDdARZwCv3M0nHxNpVUp/DIKRhQITspvxeTO+/QGyTKbgwl7Oe90Rr/X pxH8Yk0JuN6gyjBWUaTDqTpYJequ7hsiNXIUaxfSYyEA4Nmu5Enb0byy+Z/ENJ3B4n86bc NFPJyRDxAoLF7cU1NV0BAa7S3pJ+F1s= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-267-9CPImoJYPOyARge6nMgrWQ-1; Mon, 11 Jul 2022 04:32:23 -0400 X-MC-Unique: 9CPImoJYPOyARge6nMgrWQ-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4D1B18041B5; Mon, 11 Jul 2022 08:32:23 +0000 (UTC) Received: from shodan.usersys.redhat.com (unknown [10.43.17.22]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 09A5F2026D64; Mon, 11 Jul 2022 08:32:22 +0000 (UTC) Received: by shodan.usersys.redhat.com (Postfix, from userid 1000) id 061281C03BC; Mon, 11 Jul 2022 10:32:22 +0200 (CEST) From: Artem Savkov To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , bpf@vger.kernel.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Andrea Arcangeli , Artem Savkov Subject: [RFC PATCH bpf-next 4/4] selftests/bpf: bpf_panic selftest Date: Mon, 11 Jul 2022 10:32:20 +0200 Message-Id: <20220711083220.2175036-5-asavkov@redhat.com> In-Reply-To: <20220711083220.2175036-1-asavkov@redhat.com> References: <20220711083220.2175036-1-asavkov@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net X-Patchwork-State: RFC Add a selftest for bpf_panic() checking that the program will only load if all the prerequisites are met. Signed-off-by: Artem Savkov --- .../selftests/bpf/prog_tests/bpf_panic.c | 144 ++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/bpf_panic.c diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_panic.c b/tools/testing/selftests/bpf/prog_tests/bpf_panic.c new file mode 100644 index 000000000000..9d008c0a5140 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/bpf_panic.c @@ -0,0 +1,144 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2022 Red Hat, Inc. */ + +#include +#include + +#include "cap_helpers.h" + +static int sysctl_get(const char *sysctl_path, char *old_val) +{ + int ret = 0; + FILE *fp; + + fp = fopen(sysctl_path, "r"); + if (!fp) + return -errno; + + if (fscanf(fp, "%s", old_val) <= 0) + ret = -ENOENT; + + fclose(fp); + + return ret; +} + +static int sysctl_set(const char *sysctl_path, const char *new_val) +{ + int ret = 0; + FILE *fp; + + fp = fopen(sysctl_path, "w"); + if (!fp) + return -errno; + + if (fprintf(fp, "%s", new_val) < 0) + ret = -errno; + + fclose(fp); + + return ret; +} + +static char bpf_vlog[UINT_MAX >> 8]; + +static void test_bpf_panic_conditions(void) +{ + int fd_prog; + int map_fd; + struct bpf_insn prog_insns[] = { + BPF_LD_MAP_VALUE(BPF_REG_1, 0, 0), + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_panic), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }; + const size_t prog_insn_cnt = sizeof(prog_insns) / sizeof(struct bpf_insn); + LIBBPF_OPTS(bpf_prog_load_opts, load_opts); + LIBBPF_OPTS(bpf_map_create_opts, map_create_opts); + int attach_btf_id; + __u64 save_caps = 0; + + if (!ASSERT_OK(sysctl_set("/proc/sys/kernel/destructive_bpf_enabled", + "1"), "set destructive_bpf_enabled")) + return; + + load_opts.log_level = 1; + load_opts.log_buf = bpf_vlog; + load_opts.log_size = sizeof(bpf_vlog); + load_opts.expected_attach_type = BPF_TRACE_FENTRY; + + attach_btf_id = libbpf_find_vmlinux_btf_id("dentry_open", load_opts.expected_attach_type); + if (!ASSERT_GE(attach_btf_id, 0, "attach_btf_id")) + return; + + load_opts.attach_btf_id = attach_btf_id; + + map_create_opts.map_flags = BPF_F_RDONLY_PROG; + map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, NULL, 4, 8, 1, &map_create_opts); + if (!ASSERT_GE(map_fd, 0, "bpf_map_create")) + return; + ASSERT_OK(bpf_map_freeze(map_fd), "bpf_map_freeze"); + + prog_insns[0].imm = map_fd; + + fd_prog = bpf_prog_load(BPF_PROG_TYPE_TRACING, "bpf_panic", "GPL", prog_insns, prog_insn_cnt, &load_opts); + + if (ASSERT_EQ(fd_prog, -EACCES, "BPF_F_DESTRUCTIVE required")) { + if (!ASSERT_OK_PTR( + strstr(bpf_vlog, "require BPF_F_DESTRUCTIVE"), + "BPF_F_DESTRUCTIVE verifier log")) { + printf("verifier log:\n%s\n", bpf_vlog); + } + } + + load_opts.prog_flags = BPF_F_DESTRUCTIVE; + fd_prog = bpf_prog_load(BPF_PROG_TYPE_TRACING, "bpf_panic", "GPL", prog_insns, prog_insn_cnt, &load_opts); + + if (ASSERT_GE(fd_prog, 0, "successful load")) { + close(fd_prog); + } else { + printf("verifier log:\n%s\n", bpf_vlog); + } + + + if (ASSERT_OK(cap_disable_effective(1ULL << CAP_SYS_BOOT, &save_caps), "disable caps")) { + fd_prog = bpf_prog_load(BPF_PROG_TYPE_TRACING, "bpf_panic", "GPL", prog_insns, prog_insn_cnt, &load_opts); + ASSERT_EQ(fd_prog, -EINVAL, "CAP_SYS_BOOT required"); + if (!ASSERT_OK_PTR( + strstr(bpf_vlog, "unknown func bpf_panic"), + "CAP_SYS_BOOT verifier log")) { + printf("verifier log:\n%s\n", bpf_vlog); + } + cap_enable_effective(save_caps, NULL); + } + + if (ASSERT_OK(sysctl_set("/proc/sys/kernel/destructive_bpf_enabled", + "0"), "unset destructive_bpf_enabled")) { + fd_prog = bpf_prog_load(BPF_PROG_TYPE_TRACING, "bpf_panic", "GPL", prog_insns, prog_insn_cnt, &load_opts); + ASSERT_EQ(fd_prog, -EINVAL, "!destructive_bpf_enabled"); + if (!ASSERT_OK_PTR( + strstr(bpf_vlog, "unknown func bpf_panic"), + "!destructive_bpf_enabled verifier log")) { + printf("verifier log:\n%s\n", bpf_vlog); + } + } + close(map_fd); +} + +void test_bpf_panic(void) +{ + char destructive_bpf_enabled_orig[32] = {}; + + if (!ASSERT_OK(sysctl_get("/proc/sys/kernel/destructive_bpf_enabled", + destructive_bpf_enabled_orig), "read destructive_bpf_enabled")) + goto cleanup; + + libbpf_set_strict_mode(LIBBPF_STRICT_ALL); + if (test__start_subtest("bpf_panic_conditions")) + test_bpf_panic_conditions(); + +cleanup: + if (strlen(destructive_bpf_enabled_orig) > 0) + sysctl_set("/proc/sys/kernel/destructive_bpf_enabled", + destructive_bpf_enabled_orig); +}