* [PATCHv2 bpf-next] bpf: Prevent bpf program recursion for raw tracepoint probes
@ 2022-09-16 7:19 Jiri Olsa
2022-09-22 1:20 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Jiri Olsa @ 2022-09-16 7:19 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko
Cc: Stanislav Fomichev, syzbot+2251879aa068ad9c960d, bpf,
Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
KP Singh, Hao Luo
We got report from sysbot [1] about warnings that were caused by
bpf program attached to contention_begin raw tracepoint triggering
the same tracepoint by using bpf_trace_printk helper that takes
trace_printk_lock lock.
Call Trace:
<TASK>
? trace_event_raw_event_bpf_trace_printk+0x5f/0x90
bpf_trace_printk+0x2b/0xe0
bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
bpf_trace_run2+0x26/0x90
native_queued_spin_lock_slowpath+0x1c6/0x2b0
_raw_spin_lock_irqsave+0x44/0x50
bpf_trace_printk+0x3f/0xe0
bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
bpf_trace_run2+0x26/0x90
native_queued_spin_lock_slowpath+0x1c6/0x2b0
_raw_spin_lock_irqsave+0x44/0x50
bpf_trace_printk+0x3f/0xe0
bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
bpf_trace_run2+0x26/0x90
native_queued_spin_lock_slowpath+0x1c6/0x2b0
_raw_spin_lock_irqsave+0x44/0x50
bpf_trace_printk+0x3f/0xe0
bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
bpf_trace_run2+0x26/0x90
native_queued_spin_lock_slowpath+0x1c6/0x2b0
_raw_spin_lock_irqsave+0x44/0x50
__unfreeze_partials+0x5b/0x160
...
The can be reproduced by attaching bpf program as raw tracepoint on
contention_begin tracepoint. The bpf prog calls bpf_trace_printk
helper. Then by running perf bench the spin lock code is forced to
take slow path and call contention_begin tracepoint.
Fixing this by skipping execution of the bpf program if it's
already running, Using bpf prog 'active' field, which is being
currently used by trampoline programs for the same reason.
Moving bpf_prog_inc_misses_counter to syscall.c because
trampoline.c is compiled in just for CONFIG_BPF_JIT option.
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Reported-by: syzbot+2251879aa068ad9c960d@syzkaller.appspotmail.com
[1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
v2 changes:
- moved inc_misses_counter from trampoline to syscall object
to fix compilation fails found by kernel test robot
- added Stanislav's ack
include/linux/bpf.h | 6 ++++++
kernel/bpf/syscall.c | 11 +++++++++++
kernel/bpf/trampoline.c | 15 ++-------------
kernel/trace/bpf_trace.c | 6 ++++++
4 files changed, 25 insertions(+), 13 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 54178b9e9c3a..bf17f7883da7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2029,6 +2029,8 @@ static inline bool has_current_bpf_ctx(void)
{
return !!current->bpf_ctx;
}
+
+void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog);
#else /* !CONFIG_BPF_SYSCALL */
static inline struct bpf_prog *bpf_prog_get(u32 ufd)
{
@@ -2251,6 +2253,10 @@ static inline bool has_current_bpf_ctx(void)
{
return false;
}
+
+static inline void bpf_prog_inc_misses_counter(struct bpf_prog *prog)
+{
+}
#endif /* CONFIG_BPF_SYSCALL */
void __bpf_free_used_btfs(struct bpf_prog_aux *aux,
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 69be1c612daa..be7761414308 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2098,6 +2098,17 @@ struct bpf_prog_kstats {
u64 misses;
};
+void notrace bpf_prog_inc_misses_counter(struct bpf_prog *prog)
+{
+ struct bpf_prog_stats *stats;
+ unsigned int flags;
+
+ stats = this_cpu_ptr(prog->stats);
+ flags = u64_stats_update_begin_irqsave(&stats->syncp);
+ u64_stats_inc(&stats->misses);
+ u64_stats_update_end_irqrestore(&stats->syncp, flags);
+}
+
static void bpf_prog_get_stats(const struct bpf_prog *prog,
struct bpf_prog_kstats *stats)
{
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index ad76940b02cc..41b67eb83ab3 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -863,17 +863,6 @@ static __always_inline u64 notrace bpf_prog_start_time(void)
return start;
}
-static void notrace inc_misses_counter(struct bpf_prog *prog)
-{
- struct bpf_prog_stats *stats;
- unsigned int flags;
-
- stats = this_cpu_ptr(prog->stats);
- flags = u64_stats_update_begin_irqsave(&stats->syncp);
- u64_stats_inc(&stats->misses);
- u64_stats_update_end_irqrestore(&stats->syncp, flags);
-}
-
/* The logic is similar to bpf_prog_run(), but with an explicit
* rcu_read_lock() and migrate_disable() which are required
* for the trampoline. The macro is split into
@@ -896,7 +885,7 @@ u64 notrace __bpf_prog_enter(struct bpf_prog *prog, struct bpf_tramp_run_ctx *ru
run_ctx->saved_run_ctx = bpf_set_run_ctx(&run_ctx->run_ctx);
if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) {
- inc_misses_counter(prog);
+ bpf_prog_inc_misses_counter(prog);
return 0;
}
return bpf_prog_start_time();
@@ -967,7 +956,7 @@ u64 notrace __bpf_prog_enter_sleepable(struct bpf_prog *prog, struct bpf_tramp_r
might_fault();
if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) {
- inc_misses_counter(prog);
+ bpf_prog_inc_misses_counter(prog);
return 0;
}
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 68e5cdd24cef..c8cd1aa7b112 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2042,9 +2042,15 @@ static __always_inline
void __bpf_trace_run(struct bpf_prog *prog, u64 *args)
{
cant_sleep();
+ if (unlikely(this_cpu_inc_return(*(prog->active)) != 1)) {
+ bpf_prog_inc_misses_counter(prog);
+ goto out;
+ }
rcu_read_lock();
(void) bpf_prog_run(prog, args);
rcu_read_unlock();
+out:
+ this_cpu_dec(*(prog->active));
}
#define UNPACK(...) __VA_ARGS__
--
2.37.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCHv2 bpf-next] bpf: Prevent bpf program recursion for raw tracepoint probes
2022-09-16 7:19 [PATCHv2 bpf-next] bpf: Prevent bpf program recursion for raw tracepoint probes Jiri Olsa
@ 2022-09-22 1:20 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-09-22 1:20 UTC (permalink / raw)
To: Jiri Olsa
Cc: ast, daniel, andrii, sdf, syzbot+2251879aa068ad9c960d, bpf,
kafai, songliubraving, yhs, john.fastabend, kpsingh, haoluo
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:
On Fri, 16 Sep 2022 09:19:14 +0200 you wrote:
> We got report from sysbot [1] about warnings that were caused by
> bpf program attached to contention_begin raw tracepoint triggering
> the same tracepoint by using bpf_trace_printk helper that takes
> trace_printk_lock lock.
>
> Call Trace:
> <TASK>
> ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90
> bpf_trace_printk+0x2b/0xe0
> bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
> bpf_trace_run2+0x26/0x90
> native_queued_spin_lock_slowpath+0x1c6/0x2b0
> _raw_spin_lock_irqsave+0x44/0x50
> bpf_trace_printk+0x3f/0xe0
> bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
> bpf_trace_run2+0x26/0x90
> native_queued_spin_lock_slowpath+0x1c6/0x2b0
> _raw_spin_lock_irqsave+0x44/0x50
> bpf_trace_printk+0x3f/0xe0
> bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
> bpf_trace_run2+0x26/0x90
> native_queued_spin_lock_slowpath+0x1c6/0x2b0
> _raw_spin_lock_irqsave+0x44/0x50
> bpf_trace_printk+0x3f/0xe0
> bpf_prog_a9aec6167c091eef_prog+0x1f/0x24
> bpf_trace_run2+0x26/0x90
> native_queued_spin_lock_slowpath+0x1c6/0x2b0
> _raw_spin_lock_irqsave+0x44/0x50
> __unfreeze_partials+0x5b/0x160
> ...
>
> [...]
Here is the summary with links:
- [PATCHv2,bpf-next] bpf: Prevent bpf program recursion for raw tracepoint probes
https://git.kernel.org/bpf/bpf-next/c/05b24ff9b2cf
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-09-22 1:20 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-16 7:19 [PATCHv2 bpf-next] bpf: Prevent bpf program recursion for raw tracepoint probes Jiri Olsa
2022-09-22 1:20 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.