Re: bpf_jit_limit close shave

From: Frank Hofmann <fhofmann@cloudflare.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Lorenz Bauer <lmb@cloudflare.com>, bpf <bpf@vger.kernel.org>,
	Alexei Starovoitov <ast@kernel.org>,
	Andrii Nakryiko <andrii@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	kernel-team <kernel-team@cloudflare.com>
Subject: Re: bpf_jit_limit close shave
Date: Wed, 22 Sep 2021 09:20:47 +0100	[thread overview]
Message-ID: <CABEBQi=aZNfOdPH1999sfpD_dvSiOnhnudH3d=XEuQ=0q_bBCA@mail.gmail.com> (raw)
In-Reply-To: <CAADnVQKX+ngPV=ZD9+Mm-odr=g-Neqm21TtxZ_rHpt+ybs-8RQ@mail.gmail.com>

On Tue, Sep 21, 2021 at 8:59 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Tue, Sep 21, 2021 at 12:11 PM Frank Hofmann <fhofmann@cloudflare.com> wrote:
> >
> > Wouldn't that (updating the variable only for unpriv use) also make the leak impossible to notice that we ran into ?
>
> impossible?
> That jit limit is not there on older kernels and doesn't apply to root.
> How would you notice such a kernel bug in such conditions?

I'm talking about bpf_jit_current - it's an "overall gauge" for
allocation, priv and unpriv. I understood Lorenz' note as "change it
so it only tracks unpriv BPF mem usage - since we'll never act on
privileged usage anyway"

FrankH.

>
> > (we have something near to a simple reproducer for https://www.spinics.net/lists/kernel/msg4029472.html ... need to extract the relevant parts of an app of ours, will update separately when there)
> >
> > FrankH.
> >
> > On Tue, Sep 21, 2021 at 4:52 PM Lorenz Bauer <lmb@cloudflare.com> wrote:
> >>
> >> On Tue, 21 Sept 2021 at 15:34, Alexei Starovoitov
> >> <alexei.starovoitov@gmail.com> wrote:
> >> >
> >> > On Tue, Sep 21, 2021 at 4:50 AM Lorenz Bauer <lmb@cloudflare.com> wrote:
> >> > >
> >> > > Does it make sense to include !capable(CAP_BPF) in the check?
> >> >
> >> > Good point. Makes sense to add CAP_BPF there.
> >> > Taking down critical networking infrastructure because of this limit
> >> > that supposed to apply to unpriv users only is scary indeed.
> >>
> >> Ok, I'll send a patch. Can I add a Fixes: 2c78ee898d8f ("bpf:
> >> Implement CAP_BPF")?
> >>
> >> Another thought: move the check for bpf_capable before the
> >> atomic_long_add_return? This means we only track JIT allocations from
> >> unprivileged users. As it stands a privileged user can easily "lock
> >> out" unprivileged users, which on our set up is a real concern. We
> >> have several socket filters / SO_REUSEPORT programs which are
> >> critical, and also use lots of XDP from privileged processes as you
> >> know.
> >>
> >> >
> >> > > This limit reminds me a bit of the memlock issue, where a global limit
> >> > > causes coupling between independent systems / processes. Can we remove
> >> > > the limit in favour of something more fine grained?
> >> >
> >> > Right. Unfortunately memcg doesn't distinguish kernel module
> >> > memory vs any other memory. All types of memory are memory.
> >> > Regardless of whether its type is per-cpu, bpf map memory, bpf jit memory, etc.
> >> > That's the main reason for the independent knob for JITed memory.
> >> > Since it's a bit special. It's a crude knob. Certainly not perfect.
> >>
> >> I'm missing context, how is JIT memory different from these other kinds of code?
> >>
> >> Lorenz
> >>
> >> --
> >> Lorenz Bauer  |  Systems Engineer
> >> 6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
> >>
> >> www.cloudflare.com