linux-stable/kernel/bpf/preload/bpf_preload_kern.c
Yucong Sun 80bebebdac bpf: Fix issue with bpf preload module taking over stdout/stdin of kernel.
In cb80ddc671 ("bpf: Convert bpf_preload.ko to use light skeleton.")
BPF preload was switched from user mode process to use in-kernel light
skeleton instead. However, in the kernel context, early in the boot
sequence, the first available FD can start from 0, instead of normally
3 for user mode process. So FDs 0 and 1 are then used for loaded BPF
programs and prevent init process from setting up stdin/stdout/stderr on
FD 0, 1, and 2 as expected.

Before the fix:

ls -lah /proc/1/fd/*

lrwx------1 root root 64 Feb 23 17:20 /proc/1/fd/0 -> /dev/null
lrwx------ 1 root root 64 Feb 23 17:20 /proc/1/fd/1 -> /dev/null
lrwx------ 1 root root 64 Feb 23 17:20 /proc/1/fd/2 -> /dev/console
lrwx------ 1 root root 64 Feb 23 17:20 /proc/1/fd/6 -> /dev/console
lrwx------ 1 root root 64 Feb 23 17:20 /proc/1/fd/7 -> /dev/console

After the fix:

ls -lah /proc/1/fd/*

lrwx------ 1 root root 64 Feb 24 21:23 /proc/1/fd/0 -> /dev/console
lrwx------ 1 root root 64 Feb 24 21:23 /proc/1/fd/1 -> /dev/console
lrwx------ 1 root root 64 Feb 24 21:23 /proc/1/fd/2 -> /dev/console

Fix by closing prog FDs after initialization. struct bpf_prog's
themselves are kept alive through direct kernel references taken with
bpf_link_get_from_fd().

Fixes: cb80ddc671 ("bpf: Convert bpf_preload.ko to use light skeleton.")
Signed-off-by: Yucong Sun <fallentree@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20220225185923.2535519-1-fallentree@fb.com
2022-02-25 12:48:35 -08:00

88 lines
1.9 KiB
C

// SPDX-License-Identifier: GPL-2.0
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/init.h>
#include <linux/module.h>
#include "bpf_preload.h"
#include "iterators/iterators.lskel.h"
static struct bpf_link *maps_link, *progs_link;
static struct iterators_bpf *skel;
static void free_links_and_skel(void)
{
if (!IS_ERR_OR_NULL(maps_link))
bpf_link_put(maps_link);
if (!IS_ERR_OR_NULL(progs_link))
bpf_link_put(progs_link);
iterators_bpf__destroy(skel);
}
static int preload(struct bpf_preload_info *obj)
{
strlcpy(obj[0].link_name, "maps.debug", sizeof(obj[0].link_name));
obj[0].link = maps_link;
strlcpy(obj[1].link_name, "progs.debug", sizeof(obj[1].link_name));
obj[1].link = progs_link;
return 0;
}
static struct bpf_preload_ops ops = {
.preload = preload,
.owner = THIS_MODULE,
};
static int load_skel(void)
{
int err;
skel = iterators_bpf__open();
if (!skel)
return -ENOMEM;
err = iterators_bpf__load(skel);
if (err)
goto out;
err = iterators_bpf__attach(skel);
if (err)
goto out;
maps_link = bpf_link_get_from_fd(skel->links.dump_bpf_map_fd);
if (IS_ERR(maps_link)) {
err = PTR_ERR(maps_link);
goto out;
}
progs_link = bpf_link_get_from_fd(skel->links.dump_bpf_prog_fd);
if (IS_ERR(progs_link)) {
err = PTR_ERR(progs_link);
goto out;
}
/* Avoid taking over stdin/stdout/stderr of init process. Zeroing out
* makes skel_closenz() a no-op later in iterators_bpf__destroy().
*/
close_fd(skel->links.dump_bpf_map_fd);
skel->links.dump_bpf_map_fd = 0;
close_fd(skel->links.dump_bpf_prog_fd);
skel->links.dump_bpf_prog_fd = 0;
return 0;
out:
free_links_and_skel();
return err;
}
static int __init load(void)
{
int err;
err = load_skel();
if (err)
return err;
bpf_preload_ops = &ops;
return err;
}
static void __exit fini(void)
{
bpf_preload_ops = NULL;
free_links_and_skel();
}
late_initcall(load);
module_exit(fini);
MODULE_LICENSE("GPL");