Re: [PATCH bpf-next v2 13/15] libbpf: Support attaching struct_ops to a cgroup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf_map__attach_cgroup_opts() does not verify that the map has BPF_F_LINK set before calling bpf_map_update_elem(), leading to unintended global registration of the struct_ops map.
--

commit 4549a23db01bbdf38f2f884251281fc0a75a8c97
Author: Martin KaFai Lau <martin.lau@kernel.org>
Subject: Add bpf_map__attach_cgroup_opts() to attach a struct_ops map to a cgroup

This commit introduces bpf_map__attach_cgroup_opts() to allow attaching a
struct_ops map to a cgroup via a BPF link. It also extends
bpf_prog_query_opts with a type_id field to select the struct_ops type
during a BPF_STRUCT_OPS query.

> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 1368752aa13c..17f8466e33fa 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
[ ... ]
> @@ -14104,6 +14104,65 @@ struct bpf_link *bpf_map__attach_struct_ops(const struct bpf_map *map)
>  	return &link->link;
>  }
>  
> +struct bpf_link *bpf_map__attach_cgroup_opts(const struct bpf_map *map, int cgroup_fd,
> +					     const struct bpf_cgroup_opts *opts)
> +{
[ ... ]
> +	link = calloc(1, sizeof(*link));
> +	if (!link)
> +		return libbpf_err_ptr(-ENOMEM);
> +
> +	err = bpf_map_update_elem(map->fd, &zero, map->st_ops->kern_vdata, 0);

[Severity: High]
Does this function need to verify that the map has the BPF_F_LINK flag
set before calling bpf_map_update_elem()?

If a user passes a struct_ops map without the BPF_F_LINK flag to
bpf_map__attach_cgroup_opts(), bpf_map_update_elem() will globally
register the struct_ops.

The subsequent bpf_link_create() call will then fail because
BPF_STRUCT_OPS links require BPF_F_LINK. This results in the struct_ops
remaining globally active on the system despite the API returning an error.

> +	if (err && err != -EBUSY) {
> +		free(link);
> +		return libbpf_err_ptr(err);
> +	}
> +
> +	link->link.detach = bpf_link__detach_struct_ops;
> +
> +	fd = bpf_link_create(map->fd, cgroup_fd, BPF_STRUCT_OPS, &link_create_opts);
> +	if (fd < 0) {
> +		free(link);
> +		return libbpf_err_ptr(fd);
> +	}
> +
> +	link->link.fd = fd;
> +	link->map_fd = map->fd;
> +
> +	return &link->link;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623175006.3136053-1-ameryhung@gmail.com?part=13