[PATCH v2 bpf-next] bpf: Use non-executable memfds for maps

[PATCH v2 bpf-next] bpf: Use non-executable memfds for maps

[Andrei Enache]

[-- Attachment #1.1: Type: text/plain, Size: 1410 bytes --]

This patch enables use of non-executable memfds for bpf maps. [1]
As this is a recent kernel feature, the code checks errno to make sure it is available.

---
Changes in v2:
- Rebase on dad704e
- Link to v1: https://lore.kernel.org/bpf/6qGQ7n8-hGVRUbVaU4K2NOdK93nEC-Ytb1ZCWhJyHoeIJgs0plTiTHLLQ8ghWSxjdhsu7VRiTD8SSqEW0eJyssE0FGOp4fn3wNG7TS-jsq8=@proton.me/

[1] https://lwn.net/Articles/918106/
[2] 


Signed-off-by: Andrei Enache <andreien@proton.me>
---
 tools/lib/bpf/libbpf.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 66173ddb5..490b41e2d 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -1732,11 +1732,22 @@ static int sys_memfd_create(const char *name, unsigned flags)
 #define MFD_CLOEXEC 0x0001U
 #endif
 

+#ifndef MFD_NOEXEC_SEAL
+#define MFD_NOEXEC_SEAL 0x0008U
+#endif
+
 static int create_placeholder_fd(void)
 {
 	int fd;
+	int memfd;
+
+	memfd = sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC | MFD_NOEXEC_SEAL);
+
+	/* MFD_NOEXEC_SEAL is missing from older kernels */
+	if (errno == EINVAL)
+		memfd = sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC);
 

-	fd = ensure_good_fd(sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC));
+	fd = ensure_good_fd(memfd);
 	if (fd < 0)
 		return -errno;
 	return fd;
-- 

2.47.1

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [PATCH v2 bpf-next] bpf: Use non-executable memfds for maps

[Jiri Olsa]

On Sat, Dec 28, 2024 at 06:00:48PM +0000, Andrei Enache wrote:
> This patch enables use of non-executable memfds for bpf maps. [1]
> As this is a recent kernel feature, the code checks errno to make sure it is available.
> 
> ---
> Changes in v2:
> - Rebase on dad704e
> - Link to v1: https://lore.kernel.org/bpf/6qGQ7n8-hGVRUbVaU4K2NOdK93nEC-Ytb1ZCWhJyHoeIJgs0plTiTHLLQ8ghWSxjdhsu7VRiTD8SSqEW0eJyssE0FGOp4fn3wNG7TS-jsq8=@proton.me/
> 
> [1] https://lwn.net/Articles/918106/
> [2] 
> 
> 
> Signed-off-by: Andrei Enache <andreien@proton.me>
> ---
>  tools/lib/bpf/libbpf.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 66173ddb5..490b41e2d 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -1732,11 +1732,22 @@ static int sys_memfd_create(const char *name, unsigned flags)
>  #define MFD_CLOEXEC 0x0001U
>  #endif
>  
> 
> +#ifndef MFD_NOEXEC_SEAL
> +#define MFD_NOEXEC_SEAL 0x0008U
> +#endif
> +
>  static int create_placeholder_fd(void)
>  {
>  	int fd;
> +	int memfd;
> +
> +	memfd = sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC | MFD_NOEXEC_SEAL);
> +
> +	/* MFD_NOEXEC_SEAL is missing from older kernels */
> +	if (errno == EINVAL)

I think you need to check memfd < 0 before checking errno

> +		memfd = sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC);
>  
> 

nit, extra empty line in here (already)

jirka

> -	fd = ensure_good_fd(sys_memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC));
> +	fd = ensure_good_fd(memfd);
>  	if (fd < 0)
>  		return -errno;
>  	return fd;
> -- 
> 
> 2.47.1