[PATCHv5 bpf-next 0/7] bpf: Tracing and lsm programs re-attach

[PATCHv5 bpf-next 0/7] bpf: Tracing and lsm programs re-attach

[Jiri Olsa]

hi,
while adding test for pinning the module while there's
trampoline attach to it, I noticed that we don't allow
link detach and following re-attach for trampolines.
Adding that for tracing and lsm programs.

You need to have patch [1] from bpf tree for test module
attach test to pass.

v5 changes:
  - fixed missing hlist_del_init change
  - fixed several ASSERT calls
  - added extra patch for missing ';'
  - added ASSERT macros to lsm test
  - added acks

thanks,
jirka


[1] https://lore.kernel.org/bpf/20210326105900.151466-1-jolsa@kernel.org/
---
Jiri Olsa (7):
      bpf: Allow trampoline re-attach for tracing and lsm programs
      selftests/bpf: Add missing semicolon
      selftests/bpf: Add re-attach test to fentry_test
      selftests/bpf: Add re-attach test to fexit_test
      selftests/bpf: Add re-attach test to lsm test
      selftests/bpf: Test that module can't be unloaded with attached trampoline
      selftests/bpf: Use ASSERT macros in lsm test

 kernel/bpf/syscall.c                                   | 23 +++++++++++++++++------
 kernel/bpf/trampoline.c                                |  4 ++--
 tools/testing/selftests/bpf/prog_tests/fentry_test.c   | 52 +++++++++++++++++++++++++++++++++++++---------------
 tools/testing/selftests/bpf/prog_tests/fexit_test.c    | 52 +++++++++++++++++++++++++++++++++++++---------------
 tools/testing/selftests/bpf/prog_tests/module_attach.c | 23 +++++++++++++++++++++++
 tools/testing/selftests/bpf/prog_tests/test_lsm.c      | 61 +++++++++++++++++++++++++++++++++++++++++--------------------
 tools/testing/selftests/bpf/test_progs.h               |  2 +-
 7 files changed, 158 insertions(+), 59 deletions(-)

[PATCHv5 bpf-next 1/7] bpf: Allow trampoline re-attach for tracing and lsm programs

[Jiri Olsa]

Currently we don't allow re-attaching of trampolines. Once
it's detached, it can't be re-attach even when the program
is still loaded.

Adding the possibility to re-attach the loaded tracing and
lsm programs.

Fixing missing unlock with proper cleanup goto jump reported
by Julia.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 kernel/bpf/syscall.c    | 23 +++++++++++++++++------
 kernel/bpf/trampoline.c |  4 ++--
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index fd495190115e..941ca06d9dfa 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2648,14 +2648,25 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
 	 *   target_btf_id using the link_create API.
 	 *
 	 * - if tgt_prog == NULL when this function was called using the old
-         *   raw_tracepoint_open API, and we need a target from prog->aux
-         *
-         * The combination of no saved target in prog->aux, and no target
-         * specified on load is illegal, and we reject that here.
+	 *   raw_tracepoint_open API, and we need a target from prog->aux
+	 *
+	 * - if prog->aux->dst_trampoline and tgt_prog is NULL, the program
+	 *   was detached and is going for re-attachment.
 	 */
 	if (!prog->aux->dst_trampoline && !tgt_prog) {
-		err = -ENOENT;
-		goto out_unlock;
+		/*
+		 * Allow re-attach for TRACING and LSM programs. If it's
+		 * currently linked, bpf_trampoline_link_prog will fail.
+		 * EXT programs need to specify tgt_prog_fd, so they
+		 * re-attach in separate code path.
+		 */
+		if (prog->type != BPF_PROG_TYPE_TRACING &&
+		    prog->type != BPF_PROG_TYPE_LSM) {
+			err = -EINVAL;
+			goto out_unlock;
+		}
+		btf_id = prog->aux->attach_btf_id;
+		key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id);
 	}
 
 	if (!prog->aux->dst_trampoline ||
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 1f3a4be4b175..205c2cc36ad7 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -414,7 +414,7 @@ int bpf_trampoline_link_prog(struct bpf_prog *prog, struct bpf_trampoline *tr)
 	tr->progs_cnt[kind]++;
 	err = bpf_trampoline_update(tr);
 	if (err) {
-		hlist_del(&prog->aux->tramp_hlist);
+		hlist_del_init(&prog->aux->tramp_hlist);
 		tr->progs_cnt[kind]--;
 	}
 out:
@@ -437,7 +437,7 @@ int bpf_trampoline_unlink_prog(struct bpf_prog *prog, struct bpf_trampoline *tr)
 		tr->extension_prog = NULL;
 		goto out;
 	}
-	hlist_del(&prog->aux->tramp_hlist);
+	hlist_del_init(&prog->aux->tramp_hlist);
 	tr->progs_cnt[kind]--;
 	err = bpf_trampoline_update(tr);
 out:
-- 
2.30.2

[PATCHv5 bpf-next 2/7] selftests/bpf: Add missing semicolon

[Jiri Olsa]

Adding missing semicolon.

Fixes: 22ba36351631 ("selftests/bpf: Move and extend ASSERT_xxx() testing macros")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 tools/testing/selftests/bpf/test_progs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
index e87c8546230e..ee7e3b45182a 100644
--- a/tools/testing/selftests/bpf/test_progs.h
+++ b/tools/testing/selftests/bpf/test_progs.h
@@ -210,7 +210,7 @@ extern int test__join_cgroup(const char *path);
 #define ASSERT_ERR_PTR(ptr, name) ({					\
 	static int duration = 0;					\
 	const void *___res = (ptr);					\
-	bool ___ok = IS_ERR(___res)					\
+	bool ___ok = IS_ERR(___res);					\
 	CHECK(!___ok, (name), "unexpected pointer: %p\n", ___res);	\
 	___ok;								\
 })
-- 
2.30.2

[PATCHv5 bpf-next 3/7] selftests/bpf: Add re-attach test to fentry_test

[Jiri Olsa]

Adding the test to re-attach (detach/attach again) tracing
fentry programs, plus check that already linked program can't
be attached again.

Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/fentry_test.c    | 52 +++++++++++++------
 1 file changed, 37 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fentry_test.c b/tools/testing/selftests/bpf/prog_tests/fentry_test.c
index 04ebbf1cb390..7cb111b11995 100644
--- a/tools/testing/selftests/bpf/prog_tests/fentry_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/fentry_test.c
@@ -3,35 +3,57 @@
 #include <test_progs.h>
 #include "fentry_test.skel.h"
 
-void test_fentry_test(void)
+static int fentry_test(struct fentry_test *fentry_skel)
 {
-	struct fentry_test *fentry_skel = NULL;
 	int err, prog_fd, i;
 	__u32 duration = 0, retval;
+	struct bpf_link *link;
 	__u64 *result;
 
-	fentry_skel = fentry_test__open_and_load();
-	if (CHECK(!fentry_skel, "fentry_skel_load", "fentry skeleton failed\n"))
-		goto cleanup;
-
 	err = fentry_test__attach(fentry_skel);
-	if (CHECK(err, "fentry_attach", "fentry attach failed: %d\n", err))
-		goto cleanup;
+	if (!ASSERT_OK(err, "fentry_attach"))
+		return err;
+
+	/* Check that already linked program can't be attached again. */
+	link = bpf_program__attach(fentry_skel->progs.test1);
+	if (!ASSERT_ERR_PTR(link, "fentry_attach_link"))
+		return -1;
 
 	prog_fd = bpf_program__fd(fentry_skel->progs.test1);
 	err = bpf_prog_test_run(prog_fd, 1, NULL, 0,
 				NULL, NULL, &retval, &duration);
-	CHECK(err || retval, "test_run",
-	      "err %d errno %d retval %d duration %d\n",
-	      err, errno, retval, duration);
+	ASSERT_OK(err, "test_run");
+	ASSERT_EQ(retval, 0, "test_run");
 
 	result = (__u64 *)fentry_skel->bss;
-	for (i = 0; i < 6; i++) {
-		if (CHECK(result[i] != 1, "result",
-			  "fentry_test%d failed err %lld\n", i + 1, result[i]))
-			goto cleanup;
+	for (i = 0; i < sizeof(*fentry_skel->bss) / sizeof(__u64); i++) {
+		if (!ASSERT_EQ(result[i], 1, "fentry_result"))
+			return -1;
 	}
 
+	fentry_test__detach(fentry_skel);
+
+	/* zero results for re-attach test */
+	memset(fentry_skel->bss, 0, sizeof(*fentry_skel->bss));
+	return 0;
+}
+
+void test_fentry_test(void)
+{
+	struct fentry_test *fentry_skel = NULL;
+	int err;
+
+	fentry_skel = fentry_test__open_and_load();
+	if (!ASSERT_OK_PTR(fentry_skel, "fentry_skel_load"))
+		goto cleanup;
+
+	err = fentry_test(fentry_skel);
+	if (!ASSERT_OK(err, "fentry_first_attach"))
+		goto cleanup;
+
+	err = fentry_test(fentry_skel);
+	ASSERT_OK(err, "fentry_second_attach");
+
 cleanup:
 	fentry_test__destroy(fentry_skel);
 }
-- 
2.30.2

[PATCHv5 bpf-next 4/7] selftests/bpf: Add re-attach test to fexit_test

[Jiri Olsa]

Adding the test to re-attach (detach/attach again) tracing
fexit programs, plus check that already linked program can't
be attached again.

Also switching to ASSERT* macros.

Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/fexit_test.c     | 52 +++++++++++++------
 1 file changed, 37 insertions(+), 15 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/fexit_test.c b/tools/testing/selftests/bpf/prog_tests/fexit_test.c
index 78d7a2765c27..6792e41f7f69 100644
--- a/tools/testing/selftests/bpf/prog_tests/fexit_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/fexit_test.c
@@ -3,35 +3,57 @@
 #include <test_progs.h>
 #include "fexit_test.skel.h"
 
-void test_fexit_test(void)
+static int fexit_test(struct fexit_test *fexit_skel)
 {
-	struct fexit_test *fexit_skel = NULL;
 	int err, prog_fd, i;
 	__u32 duration = 0, retval;
+	struct bpf_link *link;
 	__u64 *result;
 
-	fexit_skel = fexit_test__open_and_load();
-	if (CHECK(!fexit_skel, "fexit_skel_load", "fexit skeleton failed\n"))
-		goto cleanup;
-
 	err = fexit_test__attach(fexit_skel);
-	if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err))
-		goto cleanup;
+	if (!ASSERT_OK(err, "fexit_attach"))
+		return err;
+
+	/* Check that already linked program can't be attached again. */
+	link = bpf_program__attach(fexit_skel->progs.test1);
+	if (!ASSERT_ERR_PTR(link, "fexit_attach_link"))
+		return -1;
 
 	prog_fd = bpf_program__fd(fexit_skel->progs.test1);
 	err = bpf_prog_test_run(prog_fd, 1, NULL, 0,
 				NULL, NULL, &retval, &duration);
-	CHECK(err || retval, "test_run",
-	      "err %d errno %d retval %d duration %d\n",
-	      err, errno, retval, duration);
+	ASSERT_OK(err, "test_run");
+	ASSERT_EQ(retval, 0, "test_run");
 
 	result = (__u64 *)fexit_skel->bss;
-	for (i = 0; i < 6; i++) {
-		if (CHECK(result[i] != 1, "result",
-			  "fexit_test%d failed err %lld\n", i + 1, result[i]))
-			goto cleanup;
+	for (i = 0; i < sizeof(*fexit_skel->bss) / sizeof(__u64); i++) {
+		if (!ASSERT_EQ(result[i], 1, "fexit_result"))
+			return -1;
 	}
 
+	fexit_test__detach(fexit_skel);
+
+	/* zero results for re-attach test */
+	memset(fexit_skel->bss, 0, sizeof(*fexit_skel->bss));
+	return 0;
+}
+
+void test_fexit_test(void)
+{
+	struct fexit_test *fexit_skel = NULL;
+	int err;
+
+	fexit_skel = fexit_test__open_and_load();
+	if (!ASSERT_OK_PTR(fexit_skel, "fexit_skel_load"))
+		goto cleanup;
+
+	err = fexit_test(fexit_skel);
+	if (!ASSERT_OK(err, "fexit_first_attach"))
+		goto cleanup;
+
+	err = fexit_test(fexit_skel);
+	ASSERT_OK(err, "fexit_second_attach");
+
 cleanup:
 	fexit_test__destroy(fexit_skel);
 }
-- 
2.30.2

[PATCHv5 bpf-next 5/7] selftests/bpf: Add re-attach test to lsm test

[Jiri Olsa]

Adding the test to re-attach (detach/attach again) lsm programs,
plus check that already linked program can't be attached again.

Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/test_lsm.c       | 48 +++++++++++++++----
 1 file changed, 38 insertions(+), 10 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
index 2755e4f81499..d492e76e01cf 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
@@ -18,6 +18,8 @@ char *CMD_ARGS[] = {"true", NULL};
 #define GET_PAGE_ADDR(ADDR, PAGE_SIZE)					\
 	(char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
 
+static int duration = 0;
+
 int stack_mprotect(void)
 {
 	void *buf;
@@ -51,23 +53,25 @@ int exec_cmd(int *monitored_pid)
 	return -EINVAL;
 }
 
-void test_test_lsm(void)
+static int test_lsm(struct lsm *skel)
 {
-	struct lsm *skel = NULL;
-	int err, duration = 0;
+	struct bpf_link *link;
 	int buf = 1234;
-
-	skel = lsm__open_and_load();
-	if (CHECK(!skel, "skel_load", "lsm skeleton failed\n"))
-		goto close_prog;
+	int err;
 
 	err = lsm__attach(skel);
 	if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
-		goto close_prog;
+		return err;
+
+	/* Check that already linked program can't be attached again. */
+	link = bpf_program__attach(skel->progs.test_int_hook);
+	if (CHECK(!IS_ERR(link), "attach_link",
+		  "re-attach without detach should not succeed"))
+		return -1;
 
 	err = exec_cmd(&skel->bss->monitored_pid);
 	if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
-		goto close_prog;
+		return err;
 
 	CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d\n",
 	      skel->bss->bprm_count);
@@ -77,7 +81,7 @@ void test_test_lsm(void)
 	err = stack_mprotect();
 	if (CHECK(errno != EPERM, "stack_mprotect", "want err=EPERM, got %d\n",
 		  errno))
-		goto close_prog;
+		return err;
 
 	CHECK(skel->bss->mprotect_count != 1, "mprotect_count",
 	      "mprotect_count = %d\n", skel->bss->mprotect_count);
@@ -89,6 +93,30 @@ void test_test_lsm(void)
 	CHECK(skel->bss->copy_test != 3, "copy_test",
 	      "copy_test = %d\n", skel->bss->copy_test);
 
+	lsm__detach(skel);
+
+	skel->bss->copy_test = 0;
+	skel->bss->bprm_count = 0;
+	skel->bss->mprotect_count = 0;
+	return 0;
+}
+
+void test_test_lsm(void)
+{
+	struct lsm *skel = NULL;
+	int err;
+
+	skel = lsm__open_and_load();
+	if (CHECK(!skel, "lsm_skel_load", "lsm skeleton failed\n"))
+		goto close_prog;
+
+	err = test_lsm(skel);
+	if (CHECK(err, "test_lsm", "first attach failed\n"))
+		goto close_prog;
+
+	err = test_lsm(skel);
+	CHECK(err, "test_lsm", "second attach failed\n");
+
 close_prog:
 	lsm__destroy(skel);
 }
-- 
2.30.2

[PATCHv5 bpf-next 6/7] selftests/bpf: Test that module can't be unloaded with attached trampoline

[Jiri Olsa]

Adding test to verify that once we attach module's trampoline,
the module can't be unloaded.

Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/module_attach.c  | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/module_attach.c b/tools/testing/selftests/bpf/prog_tests/module_attach.c
index 5bc53d53d86e..d85a69b7ce44 100644
--- a/tools/testing/selftests/bpf/prog_tests/module_attach.c
+++ b/tools/testing/selftests/bpf/prog_tests/module_attach.c
@@ -45,12 +45,18 @@ static int trigger_module_test_write(int write_sz)
 	return 0;
 }
 
+static int delete_module(const char *name, int flags)
+{
+	return syscall(__NR_delete_module, name, flags);
+}
+
 void test_module_attach(void)
 {
 	const int READ_SZ = 456;
 	const int WRITE_SZ = 457;
 	struct test_module_attach* skel;
 	struct test_module_attach__bss *bss;
+	struct bpf_link *link;
 	int err;
 
 	skel = test_module_attach__open();
@@ -84,6 +90,23 @@ void test_module_attach(void)
 	ASSERT_EQ(bss->fexit_ret, -EIO, "fexit_tet");
 	ASSERT_EQ(bss->fmod_ret_read_sz, READ_SZ, "fmod_ret");
 
+	test_module_attach__detach(skel);
+
+	/* attach fentry/fexit and make sure it get's module reference */
+	link = bpf_program__attach(skel->progs.handle_fentry);
+	if (!ASSERT_OK_PTR(link, "attach_fentry"))
+		goto cleanup;
+
+	ASSERT_ERR(delete_module("bpf_testmod", 0), "delete_module");
+	bpf_link__destroy(link);
+
+	link = bpf_program__attach(skel->progs.handle_fexit);
+	if (!ASSERT_OK_PTR(link, "attach_fexit"))
+		goto cleanup;
+
+	ASSERT_ERR(delete_module("bpf_testmod", 0), "delete_module");
+	bpf_link__destroy(link);
+
 cleanup:
 	test_module_attach__destroy(skel);
 }
-- 
2.30.2

[PATCHv5 bpf-next 7/7] selftests/bpf: Use ASSERT macros in lsm test

[Jiri Olsa]

Replacing CHECK with ASSERT macros.

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 .../selftests/bpf/prog_tests/test_lsm.c       | 27 +++++++------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
index d492e76e01cf..244c01125126 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
@@ -18,8 +18,6 @@ char *CMD_ARGS[] = {"true", NULL};
 #define GET_PAGE_ADDR(ADDR, PAGE_SIZE)					\
 	(char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
 
-static int duration = 0;
-
 int stack_mprotect(void)
 {
 	void *buf;
@@ -60,38 +58,33 @@ static int test_lsm(struct lsm *skel)
 	int err;
 
 	err = lsm__attach(skel);
-	if (CHECK(err, "attach", "lsm attach failed: %d\n", err))
+	if (!ASSERT_OK(err, "attach"))
 		return err;
 
 	/* Check that already linked program can't be attached again. */
 	link = bpf_program__attach(skel->progs.test_int_hook);
-	if (CHECK(!IS_ERR(link), "attach_link",
-		  "re-attach without detach should not succeed"))
+	if (!ASSERT_ERR_PTR(link, "attach_link"))
 		return -1;
 
 	err = exec_cmd(&skel->bss->monitored_pid);
-	if (CHECK(err < 0, "exec_cmd", "err %d errno %d\n", err, errno))
+	if (!ASSERT_OK(err, "exec_cmd"))
 		return err;
 
-	CHECK(skel->bss->bprm_count != 1, "bprm_count", "bprm_count = %d\n",
-	      skel->bss->bprm_count);
+	ASSERT_EQ(skel->bss->bprm_count, 1, "bprm_count");
 
 	skel->bss->monitored_pid = getpid();
 
 	err = stack_mprotect();
-	if (CHECK(errno != EPERM, "stack_mprotect", "want err=EPERM, got %d\n",
-		  errno))
+	if (!ASSERT_EQ(errno, EPERM, "stack_mprotect"))
 		return err;
 
-	CHECK(skel->bss->mprotect_count != 1, "mprotect_count",
-	      "mprotect_count = %d\n", skel->bss->mprotect_count);
+	ASSERT_EQ(skel->bss->mprotect_count, 1, "mprotect_count");
 
 	syscall(__NR_setdomainname, &buf, -2L);
 	syscall(__NR_setdomainname, 0, -3L);
 	syscall(__NR_setdomainname, ~0L, -4L);
 
-	CHECK(skel->bss->copy_test != 3, "copy_test",
-	      "copy_test = %d\n", skel->bss->copy_test);
+	ASSERT_EQ(skel->bss->copy_test, 3, "copy_test");
 
 	lsm__detach(skel);
 
@@ -107,15 +100,15 @@ void test_test_lsm(void)
 	int err;
 
 	skel = lsm__open_and_load();
-	if (CHECK(!skel, "lsm_skel_load", "lsm skeleton failed\n"))
+	if (!ASSERT_OK_PTR(skel, "lsm_skel_load"))
 		goto close_prog;
 
 	err = test_lsm(skel);
-	if (CHECK(err, "test_lsm", "first attach failed\n"))
+	if (!ASSERT_OK(err, "test_lsm_first_attach"))
 		goto close_prog;
 
 	err = test_lsm(skel);
-	CHECK(err, "test_lsm", "second attach failed\n");
+	ASSERT_OK(err, "test_lsm_second_attach");
 
 close_prog:
 	lsm__destroy(skel);
-- 
2.30.2

Re: [PATCHv5 bpf-next 1/7] bpf: Allow trampoline re-attach for tracing and lsm programs

[Andrii Nakryiko]

On Wed, Apr 14, 2021 at 5:44 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Currently we don't allow re-attaching of trampolines. Once
> it's detached, it can't be re-attach even when the program
> is still loaded.
>
> Adding the possibility to re-attach the loaded tracing and
> lsm programs.
>
> Fixing missing unlock with proper cleanup goto jump reported
> by Julia.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Julia Lawall <julia.lawall@lip6.fr>
> Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---

Acked-by: Andrii Nakryiko <andrii@kernel.org>

>  kernel/bpf/syscall.c    | 23 +++++++++++++++++------
>  kernel/bpf/trampoline.c |  4 ++--
>  2 files changed, 19 insertions(+), 8 deletions(-)
>

[...]

Re: [PATCHv5 bpf-next 2/7] selftests/bpf: Add missing semicolon

[Andrii Nakryiko]

On Wed, Apr 14, 2021 at 5:43 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Adding missing semicolon.
>
> Fixes: 22ba36351631 ("selftests/bpf: Move and extend ASSERT_xxx() testing macros")
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---

this is already fixed by 1969b3c60db6 ("selftests/bpf: Fix the
ASSERT_ERR_PTR macro")

>  tools/testing/selftests/bpf/test_progs.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
> index e87c8546230e..ee7e3b45182a 100644
> --- a/tools/testing/selftests/bpf/test_progs.h
> +++ b/tools/testing/selftests/bpf/test_progs.h
> @@ -210,7 +210,7 @@ extern int test__join_cgroup(const char *path);
>  #define ASSERT_ERR_PTR(ptr, name) ({                                   \
>         static int duration = 0;                                        \
>         const void *___res = (ptr);                                     \
> -       bool ___ok = IS_ERR(___res)                                     \
> +       bool ___ok = IS_ERR(___res);                                    \
>         CHECK(!___ok, (name), "unexpected pointer: %p\n", ___res);      \
>         ___ok;                                                          \
>  })
> --
> 2.30.2
>

Re: [PATCHv5 bpf-next 7/7] selftests/bpf: Use ASSERT macros in lsm test

[Andrii Nakryiko]

On Wed, Apr 14, 2021 at 12:52 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> Replacing CHECK with ASSERT macros.
>
> Suggested-by: Andrii Nakryiko <andrii@kernel.org>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---

thanks!

Acked-by: Andrii Nakryiko <andrii@kernel.org>

>  .../selftests/bpf/prog_tests/test_lsm.c       | 27 +++++++------------
>  1 file changed, 10 insertions(+), 17 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_lsm.c b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
> index d492e76e01cf..244c01125126 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_lsm.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_lsm.c
> @@ -18,8 +18,6 @@ char *CMD_ARGS[] = {"true", NULL};
>  #define GET_PAGE_ADDR(ADDR, PAGE_SIZE)                                 \
>         (char *)(((unsigned long) (ADDR + PAGE_SIZE)) & ~(PAGE_SIZE-1))
>

[...]

Re: [PATCHv5 bpf-next 0/7] bpf: Tracing and lsm programs re-attach

[Alexei Starovoitov]

On Wed, Apr 14, 2021 at 12:52 PM Jiri Olsa <jolsa@kernel.org> wrote:
>
> hi,
> while adding test for pinning the module while there's
> trampoline attach to it, I noticed that we don't allow
> link detach and following re-attach for trampolines.
> Adding that for tracing and lsm programs.
>
> You need to have patch [1] from bpf tree for test module
> attach test to pass.
>
> v5 changes:
>   - fixed missing hlist_del_init change
>   - fixed several ASSERT calls
>   - added extra patch for missing ';'
>   - added ASSERT macros to lsm test
>   - added acks

It doesn't work:
[   52.763254] ------------[ cut here ]------------
[   52.763767] WARNING: CPU: 2 PID: 1967 at kernel/bpf/syscall.c:2518
bpf_tracing_link_release+0x34/0x40
[   52.764666] Modules linked in: bpf_preload [last unloaded: bpf_testmod]
[   52.765310] CPU: 2 PID: 1967 Comm: test_progs Tainted: G
O      5.12.0-rc4-01652-gf03a9b92b5f3 #3293
[   52.766279] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.0-2.el7 04/01/2014
[   52.767128] RIP: 0010:bpf_tracing_link_release+0x34/0x40
[   52.767653] Code: 8b 77 48 48 8b 7f 18 e8 ea 67 02 00 85 c0 75 1a
48 8b 7b 48 e8 ad 60 02 00 48 8b 7b 50 48 85 ff 74 06 5b e9 6e ff ff
ff 5b c3 <0f> 0b eb e2 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89
fd 8b
[   52.769444] RSP: 0018:ffffc900001bfe98 EFLAGS: 00010286
[   52.769957] RAX: 00000000ffffffed RBX: ffff88810218e420 RCX: 0000000000000000
[   52.770642] RDX: ffff888105e89f80 RSI: ffffffff8118e539 RDI: ffff88811cafec10
[   52.771338] RBP: ffff88810218e420 R08: 0000000000000270 R09: 00000000000003cb
[   52.772041] R10: ffff8881002a1090 R11: ffff888237d2aaf0 R12: ffff888101951030
[   52.772729] R13: ffff888100226f20 R14: ffff88810629f180 R15: ffff888105e89f80
[   52.773419] FS:  00007f82c7b93700(0000) GS:ffff888237d00000(0000)
knlGS:0000000000000000
[   52.774213] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   52.774784] CR2: 00007f82c7ba1000 CR3: 0000000105cfc006 CR4: 00000000003706e0
[   52.775494] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   52.776199] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   52.776887] Call Trace:
[   52.777143]  bpf_link_free+0x25/0x40
[   52.777525]  bpf_link_release+0x11/0x20
[   52.777924]  __fput+0x9f/0x240
[   52.778234]  task_work_run+0x63/0xb0
[   52.778588]  exit_to_user_mode_prepare+0x132/0x140
[   52.779064]  syscall_exit_to_user_mode+0x1d/0x40
[   52.779519]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   52.780026] RIP: 0033:0x7f82c6f3815d
[   52.780384] Code: c2 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01
f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00
00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48
3d 01
test_module_attach:FAIL:delete_module unexpected success: 0
libbpf: prog 'handle_fexit': failed to attach: No such file or directory
test_module_attach:FAIL:attach_fexit unexpected error: -2
#68 module_attach:FAIL

and another in:
./test_progs -t module
[  156.660834] ------------[ cut here ]------------
[  156.661414] WARNING: CPU: 3 PID: 2511 at kernel/trace/ftrace.c:6321
ftrace_module_enable+0x33a/0x370
[  156.662445] Modules linked in: bpf_testmod(O+) bpf_preload [last
unloaded: bpf_testmod]
[  156.663325] CPU: 3 PID: 2511 Comm: test_progs Tainted: G        W
O      5.12.0-rc4-01652-gf03a9b92b5f3 #3293
[  156.664369] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.11.0-2.el7 04/01/2014
[  156.665265] RIP: 0010:ftrace_module_enable+0x33a/0x370
[  156.665890] Code: 00 00 74 9d 48 0d 00 00 00 10 48 89 45 08 e9 db
fe ff ff 8b 8b 98 01 00 00 48 01 ca 48 39 d0 0f 83 2c fd ff ff e9 66
fd ff ff <0f> 0b e9 bd fe ff ff 0f 0b e9 b6 fe ff ff 48 83 78 10 00 0f
85 dd
[  156.667822] RSP: 0018:ffffc900001c7d50 EFLAGS: 00010206
[  156.668354] RAX: 0000000000000000 RBX: ffffffffa001c380 RCX: 0000000000005000
[  156.669079] RDX: 0000000000031045 RSI: ffffffffa0019080 RDI: 0000000000000000
[  156.669793] RBP: ffff888104bd9020 R08: ffffffff83174f00 R09: 0000000000000000
[  156.670529] R10: 0000000000000001 R11: ffffffffa0019080 R12: ffff88810092e480
[  156.671368] R13: 61c8864680b583eb R14: 0000000000000002 R15: 0000000000000000
[  156.672135] FS:  00007f198becc700(0000) GS:ffff888237d80000(0000)
knlGS:0000000000000000
[  156.672973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  156.673625] CR2: 00000000006a14f0 CR3: 00000001169be003 CR4: 00000000003706e0
[  156.674411] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  156.675209] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  156.675959] Call Trace:
[  156.676209]  load_module+0x1f71/0x27d0
[  156.676623]  ? __do_sys_finit_module+0x8f/0xc0
[  156.677084]  __do_sys_finit_module+0x8f/0xc0
[  156.677525]  do_syscall_64+0x2d/0x40
[  156.677932]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  156.678465] RIP: 0033:0x7f198afa37f9
[  156.678837] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 57 76 2b 00 f7 d8 64 89
01 48
[  156.680812] RSP: 002b:00007ffc428756d8 EFLAGS: 00000202 ORIG_RAX:
0000000000000139
[  156.681614] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f198afa37f9
[  156.682344] RDX: 0000000000000000 RSI: 00000000006a14f7 RDI: 0000000000000004
[  156.683111] RBP: 00007ffc428758b8 R08: 00007f198becc700 R09: 00007ffc428758b8
[  156.683842] R10: 00007f198becc700 R11: 0000000000000202 R12: 000000000040bce0
[  156.684590] R13: 00007ffc428758b0 R14: 0000000000000000 R15: 0000000000000000
[  156.685335] ---[ end trace 7086b04742183c35 ]---
#58 ksyms_module:OK

Re: [PATCHv5 bpf-next 0/7] bpf: Tracing and lsm programs re-attach

[Jiri Olsa]

On Thu, Apr 15, 2021 at 04:45:24PM -0700, Alexei Starovoitov wrote:
> On Wed, Apr 14, 2021 at 12:52 PM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > hi,
> > while adding test for pinning the module while there's
> > trampoline attach to it, I noticed that we don't allow
> > link detach and following re-attach for trampolines.
> > Adding that for tracing and lsm programs.
> >
> > You need to have patch [1] from bpf tree for test module
> > attach test to pass.
> >
> > v5 changes:
> >   - fixed missing hlist_del_init change
> >   - fixed several ASSERT calls
> >   - added extra patch for missing ';'
> >   - added ASSERT macros to lsm test
> >   - added acks
> 
> It doesn't work:

hi,
I got the same warning when running test without the
patch [1] I mentioned:
  861de02e5f3f bpf: Take module reference for trampoline in module

I still don't see it in bpf-next/master

jirka

> [   52.763254] ------------[ cut here ]------------
> [   52.763767] WARNING: CPU: 2 PID: 1967 at kernel/bpf/syscall.c:2518
> bpf_tracing_link_release+0x34/0x40
> [   52.764666] Modules linked in: bpf_preload [last unloaded: bpf_testmod]
> [   52.765310] CPU: 2 PID: 1967 Comm: test_progs Tainted: G
> O      5.12.0-rc4-01652-gf03a9b92b5f3 #3293
> [   52.766279] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.11.0-2.el7 04/01/2014
> [   52.767128] RIP: 0010:bpf_tracing_link_release+0x34/0x40
> [   52.767653] Code: 8b 77 48 48 8b 7f 18 e8 ea 67 02 00 85 c0 75 1a
> 48 8b 7b 48 e8 ad 60 02 00 48 8b 7b 50 48 85 ff 74 06 5b e9 6e ff ff
> ff 5b c3 <0f> 0b eb e2 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89
> fd 8b
> [   52.769444] RSP: 0018:ffffc900001bfe98 EFLAGS: 00010286
> [   52.769957] RAX: 00000000ffffffed RBX: ffff88810218e420 RCX: 0000000000000000
> [   52.770642] RDX: ffff888105e89f80 RSI: ffffffff8118e539 RDI: ffff88811cafec10
> [   52.771338] RBP: ffff88810218e420 R08: 0000000000000270 R09: 00000000000003cb
> [   52.772041] R10: ffff8881002a1090 R11: ffff888237d2aaf0 R12: ffff888101951030
> [   52.772729] R13: ffff888100226f20 R14: ffff88810629f180 R15: ffff888105e89f80
> [   52.773419] FS:  00007f82c7b93700(0000) GS:ffff888237d00000(0000)
> knlGS:0000000000000000
> [   52.774213] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   52.774784] CR2: 00007f82c7ba1000 CR3: 0000000105cfc006 CR4: 00000000003706e0
> [   52.775494] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   52.776199] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   52.776887] Call Trace:
> [   52.777143]  bpf_link_free+0x25/0x40
> [   52.777525]  bpf_link_release+0x11/0x20
> [   52.777924]  __fput+0x9f/0x240
> [   52.778234]  task_work_run+0x63/0xb0
> [   52.778588]  exit_to_user_mode_prepare+0x132/0x140
> [   52.779064]  syscall_exit_to_user_mode+0x1d/0x40
> [   52.779519]  entry_SYSCALL_64_after_hwframe+0x44/0xae
> [   52.780026] RIP: 0033:0x7f82c6f3815d
> [   52.780384] Code: c2 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01
> f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00
> 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48
> 3d 01
> test_module_attach:FAIL:delete_module unexpected success: 0
> libbpf: prog 'handle_fexit': failed to attach: No such file or directory
> test_module_attach:FAIL:attach_fexit unexpected error: -2
> #68 module_attach:FAIL
> 
> and another in:
> ./test_progs -t module
> [  156.660834] ------------[ cut here ]------------
> [  156.661414] WARNING: CPU: 3 PID: 2511 at kernel/trace/ftrace.c:6321
> ftrace_module_enable+0x33a/0x370
> [  156.662445] Modules linked in: bpf_testmod(O+) bpf_preload [last
> unloaded: bpf_testmod]
> [  156.663325] CPU: 3 PID: 2511 Comm: test_progs Tainted: G        W
> O      5.12.0-rc4-01652-gf03a9b92b5f3 #3293
> [  156.664369] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
> BIOS 1.11.0-2.el7 04/01/2014
> [  156.665265] RIP: 0010:ftrace_module_enable+0x33a/0x370
> [  156.665890] Code: 00 00 74 9d 48 0d 00 00 00 10 48 89 45 08 e9 db
> fe ff ff 8b 8b 98 01 00 00 48 01 ca 48 39 d0 0f 83 2c fd ff ff e9 66
> fd ff ff <0f> 0b e9 bd fe ff ff 0f 0b e9 b6 fe ff ff 48 83 78 10 00 0f
> 85 dd
> [  156.667822] RSP: 0018:ffffc900001c7d50 EFLAGS: 00010206
> [  156.668354] RAX: 0000000000000000 RBX: ffffffffa001c380 RCX: 0000000000005000
> [  156.669079] RDX: 0000000000031045 RSI: ffffffffa0019080 RDI: 0000000000000000
> [  156.669793] RBP: ffff888104bd9020 R08: ffffffff83174f00 R09: 0000000000000000
> [  156.670529] R10: 0000000000000001 R11: ffffffffa0019080 R12: ffff88810092e480
> [  156.671368] R13: 61c8864680b583eb R14: 0000000000000002 R15: 0000000000000000
> [  156.672135] FS:  00007f198becc700(0000) GS:ffff888237d80000(0000)
> knlGS:0000000000000000
> [  156.672973] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  156.673625] CR2: 00000000006a14f0 CR3: 00000001169be003 CR4: 00000000003706e0
> [  156.674411] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  156.675209] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  156.675959] Call Trace:
> [  156.676209]  load_module+0x1f71/0x27d0
> [  156.676623]  ? __do_sys_finit_module+0x8f/0xc0
> [  156.677084]  __do_sys_finit_module+0x8f/0xc0
> [  156.677525]  do_syscall_64+0x2d/0x40
> [  156.677932]  entry_SYSCALL_64_after_hwframe+0x44/0xae
> [  156.678465] RIP: 0033:0x7f198afa37f9
> [  156.678837] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
> 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
> 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 57 76 2b 00 f7 d8 64 89
> 01 48
> [  156.680812] RSP: 002b:00007ffc428756d8 EFLAGS: 00000202 ORIG_RAX:
> 0000000000000139
> [  156.681614] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f198afa37f9
> [  156.682344] RDX: 0000000000000000 RSI: 00000000006a14f7 RDI: 0000000000000004
> [  156.683111] RBP: 00007ffc428758b8 R08: 00007f198becc700 R09: 00007ffc428758b8
> [  156.683842] R10: 00007f198becc700 R11: 0000000000000202 R12: 000000000040bce0
> [  156.684590] R13: 00007ffc428758b0 R14: 0000000000000000 R15: 0000000000000000
> [  156.685335] ---[ end trace 7086b04742183c35 ]---
> #58 ksyms_module:OK
> 

Re: [PATCHv5 bpf-next 1/7] bpf: Allow trampoline re-attach for tracing and lsm programs

[KP Singh]

On Fri, Apr 16, 2021 at 1:22 AM Andrii Nakryiko
<andrii.nakryiko@gmail.com> wrote:
>
> On Wed, Apr 14, 2021 at 5:44 PM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > Currently we don't allow re-attaching of trampolines. Once
> > it's detached, it can't be re-attach even when the program
> > is still loaded.
> >
> > Adding the possibility to re-attach the loaded tracing and
> > lsm programs.
> >
> > Fixing missing unlock with proper cleanup goto jump reported
> > by Julia.
> >
> > Reported-by: kernel test robot <lkp@intel.com>
> > Reported-by: Julia Lawall <julia.lawall@lip6.fr>
> > Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
>
> Acked-by: Andrii Nakryiko <andrii@kernel.org>

Thanks!

Acked-by: KP Singh <kpsingh@kernel.org>

Re: [PATCHv5 bpf-next 0/7] bpf: Tracing and lsm programs re-attach

[Alexei Starovoitov]

On Thu, Apr 15, 2021 at 11:56 PM Jiri Olsa <jolsa@redhat.com> wrote:
>
> On Thu, Apr 15, 2021 at 04:45:24PM -0700, Alexei Starovoitov wrote:
> > On Wed, Apr 14, 2021 at 12:52 PM Jiri Olsa <jolsa@kernel.org> wrote:
> > >
> > > hi,
> > > while adding test for pinning the module while there's
> > > trampoline attach to it, I noticed that we don't allow
> > > link detach and following re-attach for trampolines.
> > > Adding that for tracing and lsm programs.
> > >
> > > You need to have patch [1] from bpf tree for test module
> > > attach test to pass.
> > >
> > > v5 changes:
> > >   - fixed missing hlist_del_init change
> > >   - fixed several ASSERT calls
> > >   - added extra patch for missing ';'
> > >   - added ASSERT macros to lsm test
> > >   - added acks
> >
> > It doesn't work:
>
> hi,
> I got the same warning when running test without the
> patch [1] I mentioned:
>   861de02e5f3f bpf: Take module reference for trampoline in module
>
> I still don't see it in bpf-next/master

Finally applied to bpf-next.
Thank you and sorry for the delay.