netdev - [PATCH bpf-next 05/10] bpf: Implement link detach for tc BPF link programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  5 Oct 2022 01:11:38 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     bpf@...r.kernel.org
Cc:     razor@...ckwall.org, ast@...nel.org, andrii@...nel.org,
        martin.lau@...ux.dev, john.fastabend@...il.com,
        joannelkoong@...il.com, memxor@...il.com, toke@...hat.com,
        joe@...ium.io, netdev@...r.kernel.org,
        Daniel Borkmann <daniel@...earbox.net>
Subject: [PATCH bpf-next 05/10] bpf: Implement link detach for tc BPF link programs

Add support for forced detach operation of tc BPF link. This detaches the link
but without destroying it. It has the same semantics as auto-detaching of BPF
link due to e.g. net device being destroyed for tc or XDP BPF link. Meaning,
in this case the BPF link is still a valid kernel object, but is defunct given
it is not attached anywhere anymore. It still holds a reference to the BPF
program, though. This functionality allows users with enough access rights to
manually force-detach attached tc BPF link without killing respective owner
process and to then introspect/debug the BPF assets. Similar LINK_DETACH exists
also for other BPF link types.

Co-developed-by: Nikolay Aleksandrov <razor@...ckwall.org>
Signed-off-by: Nikolay Aleksandrov <razor@...ckwall.org>
Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
---
 kernel/bpf/net.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/bpf/net.c b/kernel/bpf/net.c
index a74b86bb60a9..5650f62c1315 100644
--- a/kernel/bpf/net.c
+++ b/kernel/bpf/net.c
@@ -350,6 +350,12 @@ static void xtc_link_release(struct bpf_link *l)
 	rtnl_unlock();
 }

+static int xtc_link_detach(struct bpf_link *l)
+{
+	xtc_link_release(l);
+	return 0;
+}
+
 static void xtc_link_dealloc(struct bpf_link *l)
 {
 	struct bpf_tc_link *link = container_of(l, struct bpf_tc_link, link);
@@ -393,6 +399,7 @@ static int xtc_link_fill_info(const struct bpf_link *l,

 static const struct bpf_link_ops bpf_tc_link_lops = {
 	.release	= xtc_link_release,
+	.detach		= xtc_link_detach,
 	.dealloc	= xtc_link_dealloc,
 	.update_prog	= xtc_link_update,
 	.show_fdinfo	= xtc_link_fdinfo,
-- 
2.34.1