From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62C5A1A314D; Fri, 4 Apr 2025 00:04:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743725086; cv=none; b=g56YcrC8ZGAW5mDXu+4a2X+WvbVaL3Gx7ois8TzJ68wG411cWbXmLVwmoX0yIHCnNZU0BAJSX9VoefPhm03jNiJdPtFFFzQgeVLWRSA3H+pXVROmqb1IkfoLEoZf637ZbZ9ZwR3pkM8Kq7IQmAUTyiru0Wi3M8Upz1uGCKW8WNI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1743725086; c=relaxed/simple; bh=aQOzBmEo1VKKoJxxC5YjSqATKHwoRR3RuMha6YtF2Nw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=U7XLiRyBNwk17HtUzUeBV404RVXu9KEXhp9iKGCuLsqRYT8alnNzUn0SHLRE4FtykVACXD7W+pU5jKNZn2rbe1TmTRkI+adUMchg4sglOAgKmvbV4Ui5avfL4tQ6qFmLQU643+5pShGExVCki88M0R1RfaY5NDU0H+oxopIXZY0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=R7NU5vkJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="R7NU5vkJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57AC7C4CEEC; Fri, 4 Apr 2025 00:04:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1743725086; bh=aQOzBmEo1VKKoJxxC5YjSqATKHwoRR3RuMha6YtF2Nw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R7NU5vkJpJBqG9pCdVe46XVHRSzt6Jx1xj7zLOmkS9SgbXRcE7LyQqY0WdS+kg/sW UtEYPM1469KzWyveCRenGuwg2gV//mnV0lTPT/d74IR+FVF35sTSrPZGV6OCzTopDM IYBZWMthqxiCTHq8K1l8yMwddNSz+ijr1k4DXS4kWCQk6n8xdiQZVsavsiqlby5AxU C5hfotbN9pkEkWw8J9ExaLL+2FOmmSvNrUyNJhiS8AOsg5kQwrQqHWlfI+1+kzKV1A cj/yLQgfTer9GtiYNYcLc5UW0fN5zJfrQXbq0Dk25MS7pwTn+/SsdW/8+u0rVwODNL sMQ1IUIYycVuA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Yafang Shao , Alexei Starovoitov , Sasha Levin , daniel@iogearbox.net, andrii@kernel.org, bpf@vger.kernel.org Subject: [PATCH AUTOSEL 6.14 20/23] bpf: Reject attaching fexit/fmod_ret to __noreturn functions Date: Thu, 3 Apr 2025 20:03:57 -0400 Message-Id: <20250404000402.2688049-20-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250404000402.2688049-1-sashal@kernel.org> References: <20250404000402.2688049-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.14 Content-Transfer-Encoding: 8bit From: Yafang Shao [ Upstream commit cfe816d469dce9c0864062cf65dd7b3c42adc6f8 ] If we attach fexit/fmod_ret to __noreturn functions, it will cause an issue that the bpf trampoline image will be left over even if the bpf link has been destroyed. Take attaching do_exit() with fexit for example. The fexit works as follows, bpf_trampoline + __bpf_tramp_enter + percpu_ref_get(&tr->pcref); + call do_exit() + __bpf_tramp_exit + percpu_ref_put(&tr->pcref); Since do_exit() never returns, the refcnt of the trampoline image is never decremented, preventing it from being freed. That can be verified with as follows, $ bpftool link show <<<< nothing output $ grep "bpf_trampoline_[0-9]" /proc/kallsyms ffffffffc04cb000 t bpf_trampoline_6442526459 [bpf] <<<< leftover In this patch, all functions annotated with __noreturn are rejected, except for the following cases: - Functions that result in a system reboot, such as panic, machine_real_restart and rust_begin_unwind - Functions that are never executed by tasks, such as rest_init and cpu_startup_entry - Functions implemented in assembly, such as rewind_stack_and_make_dead and xen_cpu_bringup_again, lack an associated BTF ID. With this change, attaching fexit probes to functions like do_exit() will be rejected. $ ./fexit libbpf: prog 'fexit': BPF program load failed: -EINVAL libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG -- Attaching fexit/fmod_ret to __noreturn functions is rejected. Signed-off-by: Yafang Shao Link: https://lore.kernel.org/r/20250318114447.75484-2-laoar.shao@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/bpf/verifier.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 60611df77957a..b1232c9e67fc4 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -22856,6 +22856,33 @@ BTF_ID(func, __rcu_read_unlock) #endif BTF_SET_END(btf_id_deny) +/* fexit and fmod_ret can't be used to attach to __noreturn functions. + * Currently, we must manually list all __noreturn functions here. Once a more + * robust solution is implemented, this workaround can be removed. + */ +BTF_SET_START(noreturn_deny) +#ifdef CONFIG_IA32_EMULATION +BTF_ID(func, __ia32_sys_exit) +BTF_ID(func, __ia32_sys_exit_group) +#endif +#ifdef CONFIG_KUNIT +BTF_ID(func, __kunit_abort) +BTF_ID(func, kunit_try_catch_throw) +#endif +#ifdef CONFIG_MODULES +BTF_ID(func, __module_put_and_kthread_exit) +#endif +#ifdef CONFIG_X86_64 +BTF_ID(func, __x64_sys_exit) +BTF_ID(func, __x64_sys_exit_group) +#endif +BTF_ID(func, do_exit) +BTF_ID(func, do_group_exit) +BTF_ID(func, kthread_complete_and_exit) +BTF_ID(func, kthread_exit) +BTF_ID(func, make_task_dead) +BTF_SET_END(noreturn_deny) + static bool can_be_sleepable(struct bpf_prog *prog) { if (prog->type == BPF_PROG_TYPE_TRACING) { @@ -22944,6 +22971,11 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) } else if (prog->type == BPF_PROG_TYPE_TRACING && btf_id_set_contains(&btf_id_deny, btf_id)) { return -EINVAL; + } else if ((prog->expected_attach_type == BPF_TRACE_FEXIT || + prog->expected_attach_type == BPF_MODIFY_RETURN) && + btf_id_set_contains(&noreturn_deny, btf_id)) { + verbose(env, "Attaching fexit/fmod_ret to __noreturn functions is rejected.\n"); + return -EINVAL; } key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id); -- 2.39.5