perf_event_detach_bpf_prog() broken?

perf_event_detach_bpf_prog() broken?

[Peter Zijlstra]

Hi guys,

Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
-ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
return without doing bpf_prog_put() and leaving event->prog set.

This is very 'unexpected' behaviour.

I'm not sure what's sane from the BPF side of things here, but leaving
event->prog set is really rather unexpected.

Help?

Re: perf_event_detach_bpf_prog() broken?

[Jiri Olsa]

On Tue, Oct 22, 2024 at 01:16:38PM +0200, Peter Zijlstra wrote:
> Hi guys,
> 
> Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
> -ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
> return without doing bpf_prog_put() and leaving event->prog set.
> 
> This is very 'unexpected' behaviour.
> 
> I'm not sure what's sane from the BPF side of things here, but leaving
> event->prog set is really rather unexpected.
> 
> Help?

IIUC the ENOENT should never happen in perf event context, so not
sure why we have that check.. also does not seem to be used from
lirc code, Sean?

perf_event_detach_bpf_prog is called when the event is being freed
so I think we should always put and clear the event->prog

jirka

Re: perf_event_detach_bpf_prog() broken?

[Sean Young]

On Tue, Oct 22, 2024 at 04:03:40PM +0200, Jiri Olsa wrote:
> On Tue, Oct 22, 2024 at 01:16:38PM +0200, Peter Zijlstra wrote:
> > Hi guys,
> > 
> > Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
> > -ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
> > return without doing bpf_prog_put() and leaving event->prog set.
> > 
> > This is very 'unexpected' behaviour.
> > 
> > I'm not sure what's sane from the BPF side of things here, but leaving
> > event->prog set is really rather unexpected.
> > 
> > Help?
> 
> IIUC the ENOENT should never happen in perf event context, so not
> sure why we have that check.. also does not seem to be used from
> lirc code, Sean?

You can deattach a lirc program using the bpf syscall with command 
BPF_PROG_DETACH, and if you pass an incorrect (as in, not attached) program,
then this commit ensures you get ENOENT rather than success.


Sean

> perf_event_detach_bpf_prog is called when the event is being freed
> so I think we should always put and clear the event->prog
> 
> jirka

Re: perf_event_detach_bpf_prog() broken?

[Andrii Nakryiko]

+ bpf ML

On Tue, Oct 22, 2024 at 7:03 AM Jiri Olsa <olsajiri@gmail.com> wrote:
>
> On Tue, Oct 22, 2024 at 01:16:38PM +0200, Peter Zijlstra wrote:
> > Hi guys,
> >
> > Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
> > -ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
> > return without doing bpf_prog_put() and leaving event->prog set.
> >
> > This is very 'unexpected' behaviour.
> >
> > I'm not sure what's sane from the BPF side of things here, but leaving
> > event->prog set is really rather unexpected.
> >
> > Help?
>
> IIUC the ENOENT should never happen in perf event context, so not

yep, if it does return an error it's a bug, right? So we can add
WARN_ONCE() or just drop the check, probably.

> sure why we have that check.. also does not seem to be used from
> lirc code, Sean?
>
> perf_event_detach_bpf_prog is called when the event is being freed
> so I think we should always put and clear the event->prog
>
> jirka

Re: perf_event_detach_bpf_prog() broken?

[Jiri Olsa]

On Tue, Oct 22, 2024 at 03:12:38PM +0100, Sean Young wrote:
> On Tue, Oct 22, 2024 at 04:03:40PM +0200, Jiri Olsa wrote:
> > On Tue, Oct 22, 2024 at 01:16:38PM +0200, Peter Zijlstra wrote:
> > > Hi guys,
> > > 
> > > Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
> > > -ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
> > > return without doing bpf_prog_put() and leaving event->prog set.
> > > 
> > > This is very 'unexpected' behaviour.
> > > 
> > > I'm not sure what's sane from the BPF side of things here, but leaving
> > > event->prog set is really rather unexpected.
> > > 
> > > Help?
> > 
> > IIUC the ENOENT should never happen in perf event context, so not
> > sure why we have that check.. also does not seem to be used from
> > lirc code, Sean?
> 
> You can deattach a lirc program using the bpf syscall with command 
> BPF_PROG_DETACH, and if you pass an incorrect (as in, not attached) program,
> then this commit ensures you get ENOENT rather than success.

I see.. so that's for lirc programs, but we can't detach perf event's
program like that

the program is stored in event and is detached and released only when
the event is freed, so even for ENOENT error (which can't happen) we
still need to release the event's program

I think we can just remove the check like below

jirka


---
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index e7370a321126..e4e22499956d 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2240,8 +2240,6 @@ void perf_event_detach_bpf_prog(struct perf_event *event)
 
 	old_array = bpf_event_rcu_dereference(event->tp_event->prog_array);
 	ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array);
-	if (ret == -ENOENT)
-		goto unlock;
 	if (ret < 0) {
 		bpf_prog_array_delete_safe(old_array, event->prog);
 	} else {

Re: perf_event_detach_bpf_prog() broken?

[Jiri Olsa]

On Tue, Oct 22, 2024 at 10:33:37AM -0700, Andrii Nakryiko wrote:
> + bpf ML
> 
> On Tue, Oct 22, 2024 at 7:03 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Tue, Oct 22, 2024 at 01:16:38PM +0200, Peter Zijlstra wrote:
> > > Hi guys,
> > >
> > > Per commit 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return
> > > -ENOENT if exclude_prog not found") perf_event_detach_bpf_prog() can now
> > > return without doing bpf_prog_put() and leaving event->prog set.
> > >
> > > This is very 'unexpected' behaviour.
> > >
> > > I'm not sure what's sane from the BPF side of things here, but leaving
> > > event->prog set is really rather unexpected.
> > >
> > > Help?
> >
> > IIUC the ENOENT should never happen in perf event context, so not
> 
> yep, if it does return an error it's a bug, right? So we can add
> WARN_ONCE() or just drop the check, probably.

I'm now more inclined to have the WARN there, because it's possible
return value of bpf_prog_array_copy .. I'll send the patch and let's
discuss over the change

jirka

> 
> > sure why we have that check.. also does not seem to be used from
> > lirc code, Sean?
> >
> > perf_event_detach_bpf_prog is called when the event is being freed
> > so I think we should always put and clear the event->prog
> >
> > jirka