* [PATCH bpf] bpf: Take module reference for ip in module code
@ 2021-03-23 21:15 Jiri Olsa
2021-03-24 1:22 ` Alexei Starovoitov
0 siblings, 1 reply; 4+ messages in thread
From: Jiri Olsa @ 2021-03-23 21:15 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko
Cc: netdev, bpf, Martin KaFai Lau, Song Liu, Yonghong Song,
John Fastabend, KP Singh, Steven Rostedt
Currently module can be unloaded even if there's a trampoline
register in it. It's easily reproduced by running in parallel:
# while :; do ./test_progs -t module_attach; done
# while :; do ./test_progs -t fentry_test; done
Taking the module reference in case the trampoline's ip is
within the module code. Releasing it when the trampoline's
ip is unregistered.
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
kernel/bpf/trampoline.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 1f3a4be4b175..f6cb179842b2 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -87,6 +87,27 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
return tr;
}
+static struct module *ip_module_get(unsigned long ip)
+{
+ struct module *mod;
+ int err = 0;
+
+ preempt_disable();
+ mod = __module_text_address(ip);
+ if (mod && !try_module_get(mod))
+ err = -ENOENT;
+ preempt_enable();
+ return err ? ERR_PTR(err) : mod;
+}
+
+static void ip_module_put(unsigned long ip)
+{
+ struct module *mod = __module_text_address(ip);
+
+ if (mod)
+ module_put(mod);
+}
+
static int is_ftrace_location(void *ip)
{
long addr;
@@ -108,6 +129,9 @@ static int unregister_fentry(struct bpf_trampoline *tr, void *old_addr)
ret = unregister_ftrace_direct((long)ip, (long)old_addr);
else
ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, old_addr, NULL);
+
+ if (!ret)
+ ip_module_put((unsigned long) ip);
return ret;
}
@@ -126,6 +150,7 @@ static int modify_fentry(struct bpf_trampoline *tr, void *old_addr, void *new_ad
/* first time registering */
static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
{
+ struct module *mod;
void *ip = tr->func.addr;
int ret;
@@ -134,10 +159,17 @@ static int register_fentry(struct bpf_trampoline *tr, void *new_addr)
return ret;
tr->func.ftrace_managed = ret;
+ mod = ip_module_get((unsigned long) ip);
+ if (IS_ERR(mod))
+ return -ENOENT;
+
if (tr->func.ftrace_managed)
ret = register_ftrace_direct((long)ip, (long)new_addr);
else
ret = bpf_arch_text_poke(ip, BPF_MOD_CALL, NULL, new_addr);
+
+ if (ret)
+ module_put(mod);
return ret;
}
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH bpf] bpf: Take module reference for ip in module code
2021-03-23 21:15 [PATCH bpf] bpf: Take module reference for ip in module code Jiri Olsa
@ 2021-03-24 1:22 ` Alexei Starovoitov
2021-03-24 11:31 ` Jiri Olsa
0 siblings, 1 reply; 4+ messages in thread
From: Alexei Starovoitov @ 2021-03-24 1:22 UTC (permalink / raw)
To: Jiri Olsa
Cc: Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko, netdev,
bpf, Martin KaFai Lau, Song Liu, Yonghong Song, John Fastabend,
KP Singh, Steven Rostedt
On Tue, Mar 23, 2021 at 10:15:33PM +0100, Jiri Olsa wrote:
> Currently module can be unloaded even if there's a trampoline
> register in it. It's easily reproduced by running in parallel:
>
> # while :; do ./test_progs -t module_attach; done
> # while :; do ./test_progs -t fentry_test; done
>
> Taking the module reference in case the trampoline's ip is
> within the module code. Releasing it when the trampoline's
> ip is unregistered.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
> kernel/bpf/trampoline.c | 32 ++++++++++++++++++++++++++++++++
> 1 file changed, 32 insertions(+)
>
> diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> index 1f3a4be4b175..f6cb179842b2 100644
> --- a/kernel/bpf/trampoline.c
> +++ b/kernel/bpf/trampoline.c
> @@ -87,6 +87,27 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
> return tr;
> }
>
> +static struct module *ip_module_get(unsigned long ip)
> +{
> + struct module *mod;
> + int err = 0;
> +
> + preempt_disable();
> + mod = __module_text_address(ip);
> + if (mod && !try_module_get(mod))
> + err = -ENOENT;
> + preempt_enable();
> + return err ? ERR_PTR(err) : mod;
> +}
> +
> +static void ip_module_put(unsigned long ip)
> +{
> + struct module *mod = __module_text_address(ip);
Conceptually looks correct, but how did you test it?!
Just doing your reproducer:
while :; do ./test_progs -t module_attach; done & while :; do ./test_progs -t fentry_test; done
I immediately hit:
[ 19.461162] WARNING: CPU: 1 PID: 232 at kernel/module.c:264 module_assert_mutex_or_preempt+0x2e/0x40
[ 19.477126] Call Trace:
[ 19.477464] __module_address+0x28/0xf0
[ 19.477865] ? __bpf_trace_bpf_testmod_test_write_bare+0x10/0x10 [bpf_testmod]
[ 19.478711] __module_text_address+0xe/0x60
[ 19.479156] bpf_trampoline_update+0x2ff/0x470
Which points to an obvious bug above.
How did you debug it to this module going away issue?
Why does test_progs -t fentry_test help to repro?
Or does it?
It doesn't touch anything in modules.
> +
> + if (mod)
> + module_put(mod);
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf] bpf: Take module reference for ip in module code
2021-03-24 1:22 ` Alexei Starovoitov
@ 2021-03-24 11:31 ` Jiri Olsa
2021-03-24 13:47 ` Jiri Olsa
0 siblings, 1 reply; 4+ messages in thread
From: Jiri Olsa @ 2021-03-24 11:31 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Jiri Olsa, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
netdev, bpf, Martin KaFai Lau, Song Liu, Yonghong Song,
John Fastabend, KP Singh, Steven Rostedt
On Tue, Mar 23, 2021 at 06:22:37PM -0700, Alexei Starovoitov wrote:
> On Tue, Mar 23, 2021 at 10:15:33PM +0100, Jiri Olsa wrote:
> > Currently module can be unloaded even if there's a trampoline
> > register in it. It's easily reproduced by running in parallel:
> >
> > # while :; do ./test_progs -t module_attach; done
> > # while :; do ./test_progs -t fentry_test; done
> >
> > Taking the module reference in case the trampoline's ip is
> > within the module code. Releasing it when the trampoline's
> > ip is unregistered.
> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> > kernel/bpf/trampoline.c | 32 ++++++++++++++++++++++++++++++++
> > 1 file changed, 32 insertions(+)
> >
> > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > index 1f3a4be4b175..f6cb179842b2 100644
> > --- a/kernel/bpf/trampoline.c
> > +++ b/kernel/bpf/trampoline.c
> > @@ -87,6 +87,27 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
> > return tr;
> > }
> >
> > +static struct module *ip_module_get(unsigned long ip)
> > +{
> > + struct module *mod;
> > + int err = 0;
> > +
> > + preempt_disable();
> > + mod = __module_text_address(ip);
> > + if (mod && !try_module_get(mod))
> > + err = -ENOENT;
> > + preempt_enable();
> > + return err ? ERR_PTR(err) : mod;
> > +}
> > +
> > +static void ip_module_put(unsigned long ip)
> > +{
> > + struct module *mod = __module_text_address(ip);
>
> Conceptually looks correct, but how did you test it?!
> Just doing your reproducer:
> while :; do ./test_progs -t module_attach; done & while :; do ./test_progs -t fentry_test; done
>
> I immediately hit:
> [ 19.461162] WARNING: CPU: 1 PID: 232 at kernel/module.c:264 module_assert_mutex_or_preempt+0x2e/0x40
> [ 19.477126] Call Trace:
> [ 19.477464] __module_address+0x28/0xf0
> [ 19.477865] ? __bpf_trace_bpf_testmod_test_write_bare+0x10/0x10 [bpf_testmod]
> [ 19.478711] __module_text_address+0xe/0x60
> [ 19.479156] bpf_trampoline_update+0x2ff/0x470
I don't have lockdep enabled.. ah the module_mutex is held
during module init, that's why all the code I was using as
a reference did not take it.. sorry, will fix
>
> Which points to an obvious bug above.
>
> How did you debug it to this module going away issue?
> Why does test_progs -t fentry_test help to repro?
> Or does it?
> It doesn't touch anything in modules.
test_prog also loads/unloads that module, but it could be
just insmod/rmmod instead, will change
jirka
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH bpf] bpf: Take module reference for ip in module code
2021-03-24 11:31 ` Jiri Olsa
@ 2021-03-24 13:47 ` Jiri Olsa
0 siblings, 0 replies; 4+ messages in thread
From: Jiri Olsa @ 2021-03-24 13:47 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Jiri Olsa, Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
netdev, bpf, Martin KaFai Lau, Song Liu, Yonghong Song,
John Fastabend, KP Singh, Steven Rostedt
On Wed, Mar 24, 2021 at 12:31:42PM +0100, Jiri Olsa wrote:
> On Tue, Mar 23, 2021 at 06:22:37PM -0700, Alexei Starovoitov wrote:
> > On Tue, Mar 23, 2021 at 10:15:33PM +0100, Jiri Olsa wrote:
> > > Currently module can be unloaded even if there's a trampoline
> > > register in it. It's easily reproduced by running in parallel:
> > >
> > > # while :; do ./test_progs -t module_attach; done
> > > # while :; do ./test_progs -t fentry_test; done
> > >
> > > Taking the module reference in case the trampoline's ip is
> > > within the module code. Releasing it when the trampoline's
> > > ip is unregistered.
> > >
> > > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > > ---
> > > kernel/bpf/trampoline.c | 32 ++++++++++++++++++++++++++++++++
> > > 1 file changed, 32 insertions(+)
> > >
> > > diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
> > > index 1f3a4be4b175..f6cb179842b2 100644
> > > --- a/kernel/bpf/trampoline.c
> > > +++ b/kernel/bpf/trampoline.c
> > > @@ -87,6 +87,27 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
> > > return tr;
> > > }
> > >
> > > +static struct module *ip_module_get(unsigned long ip)
> > > +{
> > > + struct module *mod;
> > > + int err = 0;
> > > +
> > > + preempt_disable();
> > > + mod = __module_text_address(ip);
> > > + if (mod && !try_module_get(mod))
> > > + err = -ENOENT;
> > > + preempt_enable();
> > > + return err ? ERR_PTR(err) : mod;
> > > +}
> > > +
> > > +static void ip_module_put(unsigned long ip)
> > > +{
> > > + struct module *mod = __module_text_address(ip);
> >
> > Conceptually looks correct, but how did you test it?!
> > Just doing your reproducer:
> > while :; do ./test_progs -t module_attach; done & while :; do ./test_progs -t fentry_test; done
> >
> > I immediately hit:
> > [ 19.461162] WARNING: CPU: 1 PID: 232 at kernel/module.c:264 module_assert_mutex_or_preempt+0x2e/0x40
> > [ 19.477126] Call Trace:
> > [ 19.477464] __module_address+0x28/0xf0
> > [ 19.477865] ? __bpf_trace_bpf_testmod_test_write_bare+0x10/0x10 [bpf_testmod]
> > [ 19.478711] __module_text_address+0xe/0x60
> > [ 19.479156] bpf_trampoline_update+0x2ff/0x470
>
> I don't have lockdep enabled.. ah the module_mutex is held
> during module init, that's why all the code I was using as
> a reference did not take it.. sorry, will fix
ah it's the missing preempt_disable ;-) ok
jirka
>
> >
> > Which points to an obvious bug above.
> >
> > How did you debug it to this module going away issue?
> > Why does test_progs -t fentry_test help to repro?
> > Or does it?
> > It doesn't touch anything in modules.
>
> test_prog also loads/unloads that module, but it could be
> just insmod/rmmod instead, will change
>
> jirka
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-03-24 13:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-23 21:15 [PATCH bpf] bpf: Take module reference for ip in module code Jiri Olsa
2021-03-24 1:22 ` Alexei Starovoitov
2021-03-24 11:31 ` Jiri Olsa
2021-03-24 13:47 ` Jiri Olsa
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.