Commit cfe816d4 authored by Yafang Shao's avatar Yafang Shao Committed by Alexei Starovoitov
Browse files

bpf: Reject attaching fexit/fmod_ret to __noreturn functions 



If we attach fexit/fmod_ret to __noreturn functions, it will cause an
issue that the bpf trampoline image will be left over even if the bpf
link has been destroyed. Take attaching do_exit() with fexit for example.
The fexit works as follows,

  bpf_trampoline
  + __bpf_tramp_enter
    + percpu_ref_get(&tr->pcref);

  + call do_exit()

  + __bpf_tramp_exit
    + percpu_ref_put(&tr->pcref);

Since do_exit() never returns, the refcnt of the trampoline image is
never decremented, preventing it from being freed. That can be verified
with as follows,

  $ bpftool link show                                   <<<< nothing output
  $ grep "bpf_trampoline_[0-9]" /proc/kallsyms
  ffffffffc04cb000 t bpf_trampoline_6442526459    [bpf] <<<< leftover

In this patch, all functions annotated with __noreturn are rejected, except
for the following cases:
- Functions that result in a system reboot, such as panic,
  machine_real_restart and rust_begin_unwind
- Functions that are never executed by tasks, such as rest_init and
  cpu_startup_entry
- Functions implemented in assembly, such as rewind_stack_and_make_dead and
  xen_cpu_bringup_again, lack an associated BTF ID.

With this change, attaching fexit probes to functions like do_exit() will
be rejected.

$ ./fexit
libbpf: prog 'fexit': BPF program load failed: -EINVAL
libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG --
Attaching fexit/fmod_ret to __noreturn functions is rejected.

Signed-off-by: default avatarYafang Shao <laoar.shao@gmail.com>
Link: https://lore.kernel.org/r/20250318114447.75484-2-laoar.shao@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent f4edc66e

kernel/bpf/verifier.c

+32 −0
Original line number Diff line number Diff line
@@ -23215,6 +23215,33 @@ BTF_ID(func, __rcu_read_unlock) 
#endif

BTF_SET_END(btf_id_deny)









/* fexit and fmod_ret can't be used to attach to __noreturn functions.









 * Currently, we must manually list all __noreturn functions here. Once a more









 * robust solution is implemented, this workaround can be removed.









 */









BTF_SET_START(noreturn_deny)









#ifdef CONFIG_IA32_EMULATION









BTF_ID(func, __ia32_sys_exit)









BTF_ID(func, __ia32_sys_exit_group)









#endif









#ifdef CONFIG_KUNIT









BTF_ID(func, __kunit_abort)









BTF_ID(func, kunit_try_catch_throw)









#endif









#ifdef CONFIG_MODULES









BTF_ID(func, __module_put_and_kthread_exit)









#endif









#ifdef CONFIG_X86_64









BTF_ID(func, __x64_sys_exit)









BTF_ID(func, __x64_sys_exit_group)









#endif









BTF_ID(func, do_exit)









BTF_ID(func, do_group_exit)









BTF_ID(func, kthread_complete_and_exit)









BTF_ID(func, kthread_exit)









BTF_ID(func, make_task_dead)









BTF_SET_END(noreturn_deny)

















static bool can_be_sleepable(struct bpf_prog *prog)









{









	if (prog->type == BPF_PROG_TYPE_TRACING) {








@@ -23301,6 +23328,11 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)







	} else if (prog->type == BPF_PROG_TYPE_TRACING &&









		   btf_id_set_contains(&btf_id_deny, btf_id)) {









		return -EINVAL;









	} else if ((prog->expected_attach_type == BPF_TRACE_FEXIT ||









		   prog->expected_attach_type == BPF_MODIFY_RETURN) &&









		   btf_id_set_contains(&noreturn_deny, btf_id)) {









		verbose(env, "Attaching fexit/fmod_ret to __noreturn functions is rejected.\n");









		return -EINVAL;









	}

















	key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id);