From patchwork Thu Apr 17 04:40:14 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiayuan Chen X-Patchwork-Id: 14054891 Received: from out-173.mta0.migadu.com (out-173.mta0.migadu.com [91.218.175.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C0F51DE2AD for ; Thu, 17 Apr 2025 04:45:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744865117; cv=none; b=QTco3XIfyHVaCiUMMVDCk69D3cyNb2WXo6CtgbCHFcBXUucBBds2E1oxIgyVhzFGXDcDElmBnDLhYRJIWmOvpeX5lCIOGJFXaMCfCqaa5qGFGQORpAhVrXPlXukyHPvBUTPacseXYaWSxIj/6+xlPhl4XjlY+OlcNI7TrfFjX/8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744865117; c=relaxed/simple; bh=vPo4QG4NL53RR6IrS9918ebEYkZH/A2adH6XSD9ZW9E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QhoQMKz+auAJRdrTZM2XmAbMtuUIw0lwxIdByRJ764RbXhuD+w3SOrP/a3jDBn1uDKGTq8tJv2Xf3FSbS+CWzasHG5dCIk2KXLMCeI3r0uGDb0bazX2qFSHE6WWPdvI/K5D1+kENI5l1Jk6VzgoRXu17YlINc8ODbSVnwRL3VuY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=Y1CVEXUg; arc=none smtp.client-ip=91.218.175.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="Y1CVEXUg" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1744865113; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=g8KJjhl4HK3mOe4QIRQp+eto7y07QRFjVt0dMaj3rC4=; b=Y1CVEXUgT9cvB5fsp+8zrWAEUYCFxcGgNylQ+0wE3oic7bQPsnvdKPtIkJA5NysxlD0/9S 8cT1zen56CJgRvIfbM+bXjyhvFTtgXy4os0PV6zK7Pg5gR/Iaf7CHBH7UsGLlyD1cSb0zd J485zZuX96j4S1ukw8NvpN3jXHZcldo= From: Jiayuan Chen To: andrii@kernel.org, martin.lau@linux.dev, bpf@vger.kernel.org Cc: alexis.lothore@bootlin.com, mrpre@163.com, Jiayuan Chen , syzbot+e6e8f6618a2d4b35e4e0@syzkaller.appspotmail.com, Alexei Starovoitov , Daniel Borkmann , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Mykola Lysenko , Shuah Khan , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v1 1/2] bpf: Create cgroup storage if needed when updating link Date: Thu, 17 Apr 2025 12:40:14 +0800 Message-ID: <20250417044041.252874-2-jiayuan.chen@linux.dev> In-Reply-To: <20250417044041.252874-1-jiayuan.chen@linux.dev> References: <20250417044041.252874-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT when we attach a prog without cgroup_storage map being used, cgroup_storage in struct bpf_prog_array_item is empty. Then, if we use BPF_LINK_UPDATE to replace old prog with a new one that uses the cgroup_storage map, we miss cgroup_storage being initiated. This cause a painc when accessing stroage in bpf_get_local_storage. Reported-by: syzbot+e6e8f6618a2d4b35e4e0@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67fc867e.050a0220.2970f9.03b8.GAE@google.com/T/ Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link") Signed-off-by: Jiayuan Chen --- kernel/bpf/cgroup.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 84f58f3d028a..cdf0211ddc79 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -770,12 +770,14 @@ static int cgroup_bpf_attach(struct cgroup *cgrp, } /* Swap updated BPF program for given link in effective program arrays across - * all descendant cgroups. This function is guaranteed to succeed. + * all descendant cgroups. */ -static void replace_effective_prog(struct cgroup *cgrp, - enum cgroup_bpf_attach_type atype, - struct bpf_cgroup_link *link) +static int replace_effective_prog(struct cgroup *cgrp, + enum cgroup_bpf_attach_type atype, + struct bpf_cgroup_link *link) { + struct bpf_cgroup_storage *new_storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; + struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = {}; struct bpf_prog_array_item *item; struct cgroup_subsys_state *css; struct bpf_prog_array *progs; @@ -784,6 +786,10 @@ static void replace_effective_prog(struct cgroup *cgrp, struct cgroup *cg; int pos; + if (bpf_cgroup_storages_alloc(storage, new_storage, link->type, + link->link.prog, cgrp)) + return -ENOMEM; + css_for_each_descendant_pre(css, &cgrp->self) { struct cgroup *desc = container_of(css, struct cgroup, self); @@ -810,8 +816,11 @@ static void replace_effective_prog(struct cgroup *cgrp, desc->bpf.effective[atype], lockdep_is_held(&cgroup_mutex)); item = &progs->items[pos]; + bpf_cgroup_storages_assign(item->cgroup_storage, storage); WRITE_ONCE(item->prog, link->link.prog); } + bpf_cgroup_storages_link(new_storage, cgrp, link->type); + return 0; } /** @@ -833,6 +842,7 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, struct bpf_prog_list *pl; struct hlist_head *progs; bool found = false; + int err; atype = bpf_cgroup_atype_find(link->type, new_prog->aux->attach_btf_id); if (atype < 0) @@ -853,7 +863,11 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, return -ENOENT; old_prog = xchg(&link->link.prog, new_prog); - replace_effective_prog(cgrp, atype, link); + err = replace_effective_prog(cgrp, atype, link); + if (err) { + xchg(&link->link.prog, old_prog); + return err; + } bpf_prog_put(old_prog); return 0; } From patchwork Thu Apr 17 04:40:15 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiayuan Chen X-Patchwork-Id: 14054892 Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EB62B18871F for ; Thu, 17 Apr 2025 04:46:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.188 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744865162; cv=none; b=s0lljcdFbN4M10ovLfNM1srMksGft4KfSoK28Y20Vm/iCkkDD7h/dS3Xq2vGJCGhLJie6i9do10kMe1/nLiYFukKawavUAKZ4m5rn70nkZc9QzdvAdSv8X88NpF39/zB8umz5VQtR3+nbXCJ7KYsDo5D5ZHgYtY3p6NpjdUwPZw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744865162; c=relaxed/simple; bh=RPXZU/aP7WbMdeCTfBXzeiUmIUu7vsCmakN5UMy60VY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NVKOEzu+DoYmQFdkXk6m/+NxMdAuaPcKKQjy19leq9Uurdmt/eimncEYi175RjRCR2Pzl/X6+VFev+HFyEBW56LrIYiymIeLfh9W+Pt904OYS8F6cr1ANo70zHitxVM5CmPEDKj5BHwfetP++s4Q4rqtAYvUWnrgjVqKyVo0NpE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=dadbc207; arc=none smtp.client-ip=91.218.175.188 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="dadbc207" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1744865158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=nu1ItUoeTVNPAi+YTEKwfobNfHWy8BGxvV0+PknfgOw=; b=dadbc20747aMlX8LMCtS5SYSYUTdkPiGHsSI6lEfGvJj2rbyiu+A3PunbjxwBYDyBkz1U/ kGYmuiyI/o3Yf5ojMol3I/3PeRSmtj4SnMR5iTmswvexNWeXbtgUis/gZFUR4Yr8l77mMN 6p33ZxbLaFvUAdPAg6Gl+eZjgN2nZDk= From: Jiayuan Chen To: andrii@kernel.org, martin.lau@linux.dev, bpf@vger.kernel.org Cc: alexis.lothore@bootlin.com, mrpre@163.com, Jiayuan Chen , Alexei Starovoitov , Daniel Borkmann , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Mykola Lysenko , Shuah Khan , Alan Maguire , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [PATCH bpf-next v1 2/2] selftests/bpf: Add link update test for cgroup_storage Date: Thu, 17 Apr 2025 12:40:15 +0800 Message-ID: <20250417044041.252874-3-jiayuan.chen@linux.dev> In-Reply-To: <20250417044041.252874-1-jiayuan.chen@linux.dev> References: <20250417044041.252874-1-jiayuan.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT Add link update test for cgroup_storage. './test_progs -a cgroup_storage_update' test_cgroup_storage_update:PASS:create cgroup 0 nsec setup_network:PASS:ip netns add cgroup_storage_ns 0 nsec setup_network:PASS:open netns 0 nsec setup_network:PASS:ip link set lo up 0 nsec test_cgroup_storage_update:PASS:setup network 0 nsec test_cgroup_storage_update:PASS:load program 0 nsec test_cgroup_storage_update:PASS:attach no map program 0 nsec test_cgroup_storage_update:PASS:bpf_link_update 0 nsec test_cgroup_storage_update:PASS:first ping 0 nsec test_cgroup_storage_update:PASS:second ping 0 nsec test_cgroup_storage_update:PASS:third ping 0 nsec 61 cgroup_storage_update:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Jiayuan Chen --- .../selftests/bpf/prog_tests/cgroup_storage.c | 45 +++++++++++++++++++ .../selftests/bpf/progs/cgroup_storage.c | 6 +++ 2 files changed, 51 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/cgroup_storage.c b/tools/testing/selftests/bpf/prog_tests/cgroup_storage.c index cf395715ced4..8478b08aa62a 100644 --- a/tools/testing/selftests/bpf/prog_tests/cgroup_storage.c +++ b/tools/testing/selftests/bpf/prog_tests/cgroup_storage.c @@ -94,3 +94,48 @@ void test_cgroup_storage(void) close(cgroup_fd); cleanup_cgroup_environment(); } + +void test_cgroup_storage_update(void) +{ + struct cgroup_storage *skel; + struct nstoken *ns = NULL; + int cgroup_fd; + int err; + + cgroup_fd = cgroup_setup_and_join(TEST_CGROUP); + if (!ASSERT_OK_FD(cgroup_fd, "create cgroup")) + return; + + if (!ASSERT_OK(setup_network(&ns), "setup network")) + goto cleanup_cgroup; + + skel = cgroup_storage__open_and_load(); + if (!ASSERT_OK_PTR(skel, "load program")) + goto cleanup_network; + + skel->links.bpf_prog_no_map = + bpf_program__attach_cgroup(skel->progs.bpf_prog_no_map, + cgroup_fd); + if (!ASSERT_OK_PTR(skel->links.bpf_prog_no_map, "attach no map prog")) + goto cleanup_progs; + + err = bpf_link_update(bpf_link__fd(skel->links.bpf_prog_no_map), + bpf_program__fd(skel->progs.bpf_prog), NULL); + if (!ASSERT_OK(err, "bpf_link_update")) + goto cleanup_progs; + + err = SYS_NOFAIL(PING_CMD); + ASSERT_OK(err, "first ping"); + err = SYS_NOFAIL(PING_CMD); + ASSERT_NEQ(err, 0, "second ping"); + err = SYS_NOFAIL(PING_CMD); + ASSERT_OK(err, "third ping"); + +cleanup_progs: + cgroup_storage__destroy(skel); +cleanup_network: + cleanup_network(ns); +cleanup_cgroup: + close(cgroup_fd); + cleanup_cgroup_environment(); +} diff --git a/tools/testing/selftests/bpf/progs/cgroup_storage.c b/tools/testing/selftests/bpf/progs/cgroup_storage.c index db1e4d2d3281..33a6013ca806 100644 --- a/tools/testing/selftests/bpf/progs/cgroup_storage.c +++ b/tools/testing/selftests/bpf/progs/cgroup_storage.c @@ -21,4 +21,10 @@ int bpf_prog(struct __sk_buff *skb) return (*counter & 1); } +SEC("cgroup_skb/egress") +int bpf_prog_no_map(struct __sk_buff *skb) +{ + return 1; +} + char _license[] SEC("license") = "GPL";