Re: [PATCH bpf-next 04/16] net: Add BPF_XDP_EGRESS as a bpf_attach_type

["Toke Høiland-Jørgensen" <toke@redhat.com>]

Alexei Starovoitov <alexei.starovoitov@gmail.com> writes:

> On Thu, Apr 23, 2020 at 9:40 AM Toke Høiland-Jørgensen <toke@redhat.com> wrote:
>>
>> Alexei Starovoitov <alexei.starovoitov@gmail.com> writes:
>>
>> > On Wed, Apr 22, 2020 at 05:51:36PM +0200, Toke Høiland-Jørgensen wrote:
>> >> David Ahern <dsahern@gmail.com> writes:
>> >>
>> >> > On 4/22/20 9:27 AM, Toke Høiland-Jørgensen wrote:
>> >> >> And as I said in the beginning, I'm perfectly happy to be told why I'm
>> >> >> wrong; but so far you have just been arguing that I'm out of scope ;)
>> >> >
>> >> > you are arguing about a suspected bug with existing code that is no way
>> >> > touched or modified by this patch set, so yes it is out of scope.
>> >>
>> >> Your patch is relying on the (potentially buggy) behaviour, so I don't
>> >> think it's out of scope to mention it in this context.
>> >
>> > Sorry for slow reply.
>> > I'm swamped with other things atm.
>> >
>> > Looks like there is indeed a bug in prog_type_ext handling code that
>> > is doing
>> > env->ops = bpf_verifier_ops[tgt_prog->type];
>> > I'm not sure whether the verifier can simply add:
>> > prog->expected_attach_type = tgt_prog->expected_attach_type;
>> > and be done with it.
>> > Likely yes, since expected_attach_type must be zero at that point
>> > that is enforced by bpf_prog_load_check_attach().
>> > So I suspect it's a single line fix.
>>
>> Not quite: the check in bpf_tracing_prog_attach() that enforces
>> prog->expected_attach_type==0 also needs to go. So 5 lines :)
>
> prog_ext's expected_attach_type needs to stay zero.
> It needs to be inherited from tgt prog. Hence one line:
> prog->expected_attach_type = tgt_prog->expected_attach_type;

Not sure I follow you here? I ended up with the patch below - without
the first hunk I can't attach freplace funcs to an xdp egress prog
(since the expected_attach_type will have been propagated from
verification time), and so that check will fail. Or am I missing
something?

-Toke



diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d85f37239540..40c3103c7233 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2381,10 +2381,6 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog)
                }
                break;
        case BPF_PROG_TYPE_EXT:
-               if (prog->expected_attach_type != 0) {
-                       err = -EINVAL;
-                       goto out_put_prog;
-               }
                break;
        case BPF_PROG_TYPE_LSM:
                if (prog->expected_attach_type != BPF_LSM_MAC) {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 513d9c545176..41c31773a3c4 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10485,6 +10485,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
                                return -EINVAL;
                        }
                        env->ops = bpf_verifier_ops[tgt_prog->type];
+                       prog->expected_attach_type = tgt_prog->expected_attach_type;
                }
                if (!tgt_prog->jited) {
                        verbose(env, "Can attach to only JITed progs\n");