From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="A1inhCL9" X-Greylist: delayed 566 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Wed, 13 Dec 2023 09:09:05 PST Received: from out-176.mta0.migadu.com (out-176.mta0.migadu.com [91.218.175.176]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D2042F2 for ; Wed, 13 Dec 2023 09:09:05 -0800 (PST) Message-ID: <6960ef41-fe22-4297-adc7-c85264288b6d@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1702486777; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=p4lJ6fuy6gVgOBLJgySJCzr4DpnAgH48SfeJ2oQaas8=; b=A1inhCL90hXyszEVY0knTkLQ/A4/3UIByKIh3eamKJfjCkdCG6PcVsh9j0f3y2gNyDIzPQ SwWY3FuNgxxpjGm06LZu4YviM+nKHDMxGRJfSDmQJDzw2qqwM9l3oYy4MNIt3X4z9mgpEj 8QxbZSU2G6ruY81+VFFeNt4dzBwTc6w= Date: Wed, 13 Dec 2023 08:59:26 -0800 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [RFC PATCH v3 1/3] bpf: cgroup: Introduce helper cgroup_bpf_current_enabled() Content-Language: en-GB To: =?UTF-8?Q?Michael_Wei=C3=9F?= , Christian Brauner , Alexander Mikhalitsyn , Alexei Starovoitov , Paul Moore Cc: Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Quentin Monnet , Alexander Viro , Miklos Szeredi , Amir Goldstein , "Serge E. Hallyn" , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, gyroidos@aisec.fraunhofer.de, Alexander Mikhalitsyn References: <20231213143813.6818-1-michael.weiss@aisec.fraunhofer.de> <20231213143813.6818-2-michael.weiss@aisec.fraunhofer.de> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Yonghong Song In-Reply-To: <20231213143813.6818-2-michael.weiss@aisec.fraunhofer.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT On 12/13/23 6:38 AM, Michael Weiß wrote: > This helper can be used to check if a cgroup-bpf specific program is > active for the current task. > > Signed-off-by: Michael Weiß > Reviewed-by: Alexander Mikhalitsyn > --- > include/linux/bpf-cgroup.h | 2 ++ > kernel/bpf/cgroup.c | 14 ++++++++++++++ > 2 files changed, 16 insertions(+) > > diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h > index a789266feac3..7cb49bde09ff 100644 > --- a/include/linux/bpf-cgroup.h > +++ b/include/linux/bpf-cgroup.h > @@ -191,6 +191,8 @@ static inline bool cgroup_bpf_sock_enabled(struct sock *sk, > return array != &bpf_empty_prog_array.hdr; > } > > +bool cgroup_bpf_current_enabled(enum cgroup_bpf_attach_type type); > + > /* Wrappers for __cgroup_bpf_run_filter_skb() guarded by cgroup_bpf_enabled. */ > #define BPF_CGROUP_RUN_PROG_INET_INGRESS(sk, skb) \ > ({ \ > diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c > index 491d20038cbe..9007165abe8c 100644 > --- a/kernel/bpf/cgroup.c > +++ b/kernel/bpf/cgroup.c > @@ -24,6 +24,20 @@ > DEFINE_STATIC_KEY_ARRAY_FALSE(cgroup_bpf_enabled_key, MAX_CGROUP_BPF_ATTACH_TYPE); > EXPORT_SYMBOL(cgroup_bpf_enabled_key); > > +bool cgroup_bpf_current_enabled(enum cgroup_bpf_attach_type type) > +{ > + struct cgroup *cgrp; > + struct bpf_prog_array *array; > + > + rcu_read_lock(); > + cgrp = task_dfl_cgroup(current); > + rcu_read_unlock(); > + > + array = rcu_access_pointer(cgrp->bpf.effective[type]); This seems wrong here. The cgrp could become invalid once leaving rcu critical section. > + return array != &bpf_empty_prog_array.hdr; I guess you need include 'array' usage as well in the rcu cs. So overall should look like: rcu_read_lock(); cgrp = task_dfl_cgroup(current); array = rcu_access_pointer(cgrp->bpf.effective[type]); bpf_prog_exists = array != &bpf_empty_prog_array.hdr; rcu_read_unlock(); return bpf_prog_exists; > +} > +EXPORT_SYMBOL(cgroup_bpf_current_enabled); > + > /* __always_inline is necessary to prevent indirect call through run_prog > * function pointer. > */