[v3,bpf-next,2/5] bpf: Search for kptrs in prog BTF structs

Commit Message

Amery Hung Aug. 9, 2024, 12:51 a.m. UTC

From: Dave Marchevsky <[e-mail]>

Currently btf_parse_fields is used in two places to create struct
btf_record's for structs: when looking at mapval type, and when looking
at any struct in program BTF. The former looks for kptr fields while the
latter does not. This patch modifies the btf_parse_fields call made when
looking at prog BTF struct types to search for kptrs as well.

Before this series there was no reason to search for kptrs in non-mapval
types: a referenced kptr needs some owner to guarantee resource cleanup,
and map values were the only owner that supported this. If a struct with
a kptr field were to have some non-kptr-aware owner, the kptr field
might not be properly cleaned up and result in resources leaking. Only
searching for kptr fields in mapval was a simple way to avoid this
problem.

In practice, though, searching for BPF_KPTR when populating
struct_meta_tab does not expose us to this risk, as struct_meta_tab is
only accessed through btf_find_struct_meta helper, and that helper is
only called in contexts where recognizing the kptr field is safe:

  * PTR_TO_BTF_ID reg w/ MEM_ALLOC flag
    * Such a reg is a local kptr and must be free'd via bpf_obj_drop,
      which will correctly handle kptr field

  * When handling specific kfuncs which either expect MEM_ALLOC input or
    return MEM_ALLOC output (obj_{new,drop}, percpu_obj_{new,drop},
    list+rbtree funcs, refcount_acquire)
     * Will correctly handle kptr field for same reasons as above

  * When looking at kptr pointee type
     * Called by functions which implement "correct kptr resource
       handling"

  * In btf_check_and_fixup_fields
     * Helper that ensures no ownership loops for lists and rbtrees,
       doesn't care about kptr field existence

So we should be able to find BPF_KPTR fields in all prog BTF structs
without leaking resources.

Further patches in the series will build on this change to support
kptr_xchg into non-mapval local kptr. Without this change there would be
no kptr field found in such a type.

Acked-by: Martin KaFai Lau <[e-mail]>
Signed-off-by: Dave Marchevsky <[e-mail]>
Signed-off-by: Amery Hung <[e-mail]>
---
 kernel/bpf/btf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Hou Tao Aug. 10, 2024, 10:17 a.m. UTC | #1

On 8/9/2024 8:51 AM, Amery Hung wrote:
> From: Dave Marchevsky <[e-mail]>
>
> Currently btf_parse_fields is used in two places to create struct
> btf_record's for structs: when looking at mapval type, and when looking
> at any struct in program BTF. The former looks for kptr fields while the
> latter does not. This patch modifies the btf_parse_fields call made when
> looking at prog BTF struct types to search for kptrs as well.
>
> Before this series there was no reason to search for kptrs in non-mapval
> types: a referenced kptr needs some owner to guarantee resource cleanup,
> and map values were the only owner that supported this. If a struct with
> a kptr field were to have some non-kptr-aware owner, the kptr field
> might not be properly cleaned up and result in resources leaking. Only
> searching for kptr fields in mapval was a simple way to avoid this
> problem.
>
> In practice, though, searching for BPF_KPTR when populating
> struct_meta_tab does not expose us to this risk, as struct_meta_tab is
> only accessed through btf_find_struct_meta helper, and that helper is
> only called in contexts where recognizing the kptr field is safe:
>
>   * PTR_TO_BTF_ID reg w/ MEM_ALLOC flag
>     * Such a reg is a local kptr and must be free'd via bpf_obj_drop,
>       which will correctly handle kptr field
>
>   * When handling specific kfuncs which either expect MEM_ALLOC input or
>     return MEM_ALLOC output (obj_{new,drop}, percpu_obj_{new,drop},
>     list+rbtree funcs, refcount_acquire)
>      * Will correctly handle kptr field for same reasons as above
>
>   * When looking at kptr pointee type
>      * Called by functions which implement "correct kptr resource
>        handling"
>
>   * In btf_check_and_fixup_fields
>      * Helper that ensures no ownership loops for lists and rbtrees,
>        doesn't care about kptr field existence
>
> So we should be able to find BPF_KPTR fields in all prog BTF structs
> without leaking resources.
>
> Further patches in the series will build on this change to support
> kptr_xchg into non-mapval local kptr. Without this change there would be
> no kptr field found in such a type.
>
> Acked-by: Martin KaFai Lau <[e-mail]>
> Signed-off-by: Dave Marchevsky <[e-mail]>
> Signed-off-by: Amery Hung <[e-mail]>

Acked-by: Hou Tao <[e-mail]>

Patch

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index deacf9d7b276..afc53ad396ab 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5585,7 +5585,8 @@  btf_parse_struct_metas(struct bpf_verifier_log *log, struct btf *btf)
 		type = &tab->types[tab->cnt];
 		type->btf_id = i;
 		record = btf_parse_fields(btf, t, BPF_SPIN_LOCK | BPF_LIST_HEAD | BPF_LIST_NODE |
-						  BPF_RB_ROOT | BPF_RB_NODE | BPF_REFCOUNT, t->size);
+						  BPF_RB_ROOT | BPF_RB_NODE | BPF_REFCOUNT |
+						  BPF_KPTR, t->size);
 		/* The record cannot be unset, treat it as an error if so */
 		if (IS_ERR_OR_NULL(record)) {
 			ret = PTR_ERR_OR_ZERO(record) ?: -EFAULT;