linux-kernel - Re: [PATCH v3,bpf-next] samples/bpf: check detach prog exist or not in xdp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 25 May 2022 13:15:28 +0200
From:   Toke Høiland-Jørgensen <toke@...nel.org>
To:     Zhengchao Shao <shaozhengchao@...wei.com>, bpf@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        ast@...nel.org, daniel@...earbox.net, davem@...emloft.net,
        kuba@...nel.org, hawk@...nel.org, john.fastabend@...il.com,
        andrii@...nel.org, kafai@...com, songliubraving@...com, yhs@...com,
        kpsingh@...nel.org
Cc:     weiyongjun1@...wei.com, shaozhengchao@...wei.com,
        yuehaibing@...wei.com
Subject: Re: [PATCH v3,bpf-next] samples/bpf: check detach prog exist or not
 in xdp_fwd

Zhengchao Shao <shaozhengchao@...wei.com> writes:

> Before detach the prog, we should check detach prog exist or not.
>
> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
> ---
>  samples/bpf/xdp_fwd_user.c | 59 ++++++++++++++++++++++++++++++++------
>  1 file changed, 50 insertions(+), 9 deletions(-)
>
> diff --git a/samples/bpf/xdp_fwd_user.c b/samples/bpf/xdp_fwd_user.c
> index 1828487bae9a..03a50f64e99a 100644
> --- a/samples/bpf/xdp_fwd_user.c
> +++ b/samples/bpf/xdp_fwd_user.c
> @@ -47,17 +47,58 @@ static int do_attach(int idx, int prog_fd, int map_fd, const char *name)
>  	return err;
>  }
>  
> -static int do_detach(int idx, const char *name)
> +static int do_detach(int ifindex, const char *ifname, const char *app_name)
>  {
> -	int err;
> +	LIBBPF_OPTS(bpf_xdp_attach_opts, opts);
> +	struct bpf_prog_info prog_info = {};
> +	char prog_name[BPF_OBJ_NAME_LEN];
> +	__u32 info_len, curr_prog_id;
> +	int prog_fd;
> +	int err = 1;
> +
> +	if (bpf_xdp_query_id(ifindex, xdp_flags, &curr_prog_id)) {
> +		printf("ERROR: bpf_xdp_query_id failed (%s)\n",
> +		       strerror(errno));
> +		return err;
> +	}
> +
> +	if (!curr_prog_id) {
> +		printf("ERROR: flags(0x%x) xdp prog is not attached to %s\n",
> +		       xdp_flags, ifname);
> +		return err;
> +	}
>  
> -	err = bpf_xdp_detach(idx, xdp_flags, NULL);
> -	if (err < 0)
> -		printf("ERROR: failed to detach program from %s\n", name);
> +	info_len = sizeof(prog_info);
> +	prog_fd = bpf_prog_get_fd_by_id(curr_prog_id);

This fd is never closed again; you'll need to replace the 'return err'
statement below with a 'goto err' and add a label at the end that closes
the fd before returning - see comments below.

> +	if (prog_fd < 0) {
> +		printf("ERROR: bpf_prog_get_fd_by_id failed (%s)\n",
> +		       strerror(errno));
> +		return err;

err is not actually set here; you could either 'return prog_fd' or
'return -errno'.

> +	}
> +
> +	err = bpf_obj_get_info_by_fd(prog_fd, &prog_info, &info_len);
> +	if (err) {
> +		printf("ERROR: bpf_obj_get_info_by_fd failed (%s)\n",
> +		       strerror(errno));
> +		return err;

make this 'goto err'...
> +	}
> +	snprintf(prog_name, sizeof(prog_name), "%s_prog", app_name);
> +	prog_name[BPF_OBJ_NAME_LEN - 1] = '\0';
> +
> +	if (strcmp(prog_info.name, prog_name)) {
> +		printf("ERROR: %s isn't attached to %s\n", app_name, ifname);
> +		err = 1;
> +	} else {
> +		opts.old_prog_fd = prog_fd;
> +		err = bpf_xdp_detach(ifindex, xdp_flags, &opts);
> +		if (err < 0)
> +			printf("ERROR: failed to detach program from %s (%s)\n",
> +			       ifname, strerror(errno));
> +		/* TODO: Remember to cleanup map, when adding use of shared map
> +		 *  bpf_map_delete_elem((map_fd, &idx);
> +		 */
> +	}
>  
> -	/* TODO: Remember to cleanup map, when adding use of shared map
> -	 *  bpf_map_delete_elem((map_fd, &idx);
> -	 */
...and add something like:

err:
        close(prog_fd);
>  	return err;
>  }
>  
> @@ -169,7 +210,7 @@ int main(int argc, char **argv)
>  			return 1;
>  		}
>  		if (!attach) {
> -			err = do_detach(idx, argv[i]);
> +			err = do_detach(idx, argv[i], prog_name);
>  			if (err)
>  				ret = err;
>  		} else {
> -- 
> 2.17.1