Commit 9e4dc892 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs' 

Dmitrii Banshchikov says:

====================

Various locking issues are possible with bpf_ktime_get_coarse_ns() and
bpf_timer_* set of helpers.

syzbot found a locking issue with bpf_ktime_get_coarse_ns() helper executed in
BPF_PROG_TYPE_PERF_EVENT prog type - [1]. The issue is possible because the
helper uses non fast version of time accessor that isn't safe for any context.
The helper was added because it provided performance benefits in comparison to
bpf_ktime_get_ns() helper.

A similar locking issue is possible with bpf_timer_* set of helpers when used
in tracing progs.

The solution is to restrict use of the helpers in tracing progs.

In the [1] discussion it was stated that bpf_spin_lock related helpers shall
also be excluded for tracing progs. The verifier has a compatibility check
between a map and a program. If a tracing program tries to use a map which
value has struct bpf_spin_lock the verifier fails that is why bpf_spin_lock is
already restricted.

Patch 1 restricts helpers
Patch 2 adds tests

v1 -> v2:
 * Limit the helpers via func proto getters instead of allowed callback
 * Add note about helpers' restrictions to linux/bpf.h
 * Add Fixes tag
 * Remove extra \0 from btf_str_sec
 * Beside asm tests add prog tests
 * Trim CC

1. https://lore.kernel.org/all/00000000000013aebd05cff8e064@google.com/


====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents ba05fd36 e60e6962

kernel/bpf/cgroup.c

+2 −0
Original line number Diff line number Diff line
@@ -1809,6 +1809,8 @@ sysctl_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
		return &bpf_sysctl_get_new_value_proto;

	case BPF_FUNC_sysctl_set_new_value:

		return &bpf_sysctl_set_new_value_proto;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	default:

		return cgroup_base_func_proto(func_id, prog);

	}

kernel/bpf/helpers.c

+0 −2
Original line number Diff line number Diff line
@@ -1364,8 +1364,6 @@ bpf_base_func_proto(enum bpf_func_id func_id) 
		return &bpf_ktime_get_ns_proto;

	case BPF_FUNC_ktime_get_boot_ns:

		return &bpf_ktime_get_boot_ns_proto;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	case BPF_FUNC_ringbuf_output:

		return &bpf_ringbuf_output_proto;

	case BPF_FUNC_ringbuf_reserve:

kernel/bpf/verifier.c

+7 −0
Original line number Diff line number Diff line
@@ -11632,6 +11632,13 @@ static int check_map_prog_compatibility(struct bpf_verifier_env *env, 
		}

	}



	if (map_value_has_timer(map)) {

		if (is_tracing_prog_type(prog_type)) {

			verbose(env, "tracing progs cannot use bpf_timer yet\n");

			return -EINVAL;

		}

	}



	if ((bpf_prog_is_dev_bound(prog->aux) || bpf_map_is_dev_bound(map)) &&

	    !bpf_offload_prog_map_match(prog, map)) {

		verbose(env, "offload device mismatch between prog and map\n");

kernel/trace/bpf_trace.c

+0 −2
Original line number Diff line number Diff line
@@ -1111,8 +1111,6 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
		return &bpf_ktime_get_ns_proto;

	case BPF_FUNC_ktime_get_boot_ns:

		return &bpf_ktime_get_boot_ns_proto;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	case BPF_FUNC_tail_call:

		return &bpf_tail_call_proto;

	case BPF_FUNC_get_current_pid_tgid:

net/core/filter.c

+6 −0
Original line number Diff line number Diff line
@@ -7162,6 +7162,8 @@ sock_filter_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) 
#endif

	case BPF_FUNC_sk_storage_get:

		return &bpf_sk_storage_get_cg_sock_proto;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	default:

		return bpf_base_func_proto(func_id);

	}
@@ -10327,6 +10329,8 @@ sk_reuseport_func_proto(enum bpf_func_id func_id, 
		return &sk_reuseport_load_bytes_relative_proto;

	case BPF_FUNC_get_socket_cookie:

		return &bpf_get_socket_ptr_cookie_proto;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	default:

		return bpf_base_func_proto(func_id);

	}
@@ -10833,6 +10837,8 @@ bpf_sk_base_func_proto(enum bpf_func_id func_id) 
	case BPF_FUNC_skc_to_unix_sock:

		func = &bpf_skc_to_unix_sock_proto;

		break;

	case BPF_FUNC_ktime_get_coarse_ns:

		return &bpf_ktime_get_coarse_ns_proto;

	default:

		return bpf_base_func_proto(func_id);

	}