bpf: Fix WARNING in bpf_tracing_link_release

The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.

1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn.
2. Another fexit loaded with the same tail_call_reachable prog target.

    'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'.

3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn.

[    3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98
...
[    3.428793]  bpf_link_free+0x58/0x130
[    3.429293]  bpf_link_release+0x23/0x30

Fix the warning by updating 'tr->flags' with '|=' and lock.

Fixes 2b5dcb31a19a ("bpf, x64: Fix tailcall infinite loop")

Acked-by Jiri Olsa <[email protected]>

Signed-off-by Leon Hwang <[email protected]>

---
  include/linux/bpf.h     | 2 ++
  kernel/bpf/trampoline.c | 7 +++++++
  kernel/bpf/verifier.c   | 2 +-
  3 files changed, 10 insertions(+), 1 deletion(-)

include/linux/bpf.h +2 -0

index e066f44a9c05..7bfc28673124 100644
@@ -1523,6 +1523,7 @@ int bpf_trampoline_multi_attach(struct bpf_prog *prog, u32 *ids,
  				struct bpf_tracing_multi_link *link);
  int bpf_trampoline_multi_detach(struct bpf_prog *prog,
  				struct bpf_tracing_multi_link *link);
+void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags);
 
  /*
   * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn

@@ -1646,6 +1647,7 @@ static inline int bpf_trampoline_multi_detach(struct bpf_prog *prog,
  {
  	return -ENOTSUPP;
  }
+static inline void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags) {}
  #endif
 
  struct bpf_func_info_aux {

kernel/bpf/trampoline.c +7 -0

index 6eadf64f7ec9..129d07db117e 100644
@@ -670,6 +670,13 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, int size)
  	return ERR_PTR(err);
  }
 
+void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags)
+{
+	trampoline_lock(tr);
+	tr->flags |= flags;
+	trampoline_unlock(tr);
+}
+
  static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mutex,
  				 const struct bpf_trampoline_ops *ops, void *data)
  {

kernel/bpf/verifier.c +0 -0

index 52be0a118cce..66d8d9eaec05 100644

Add a test to verify that there's no WARNING when detaching fexit link by following the repro steps of previous commit.

Without the fix, the WARNING could be triggered by this test.

Acked-by Jiri Olsa <[email protected]>

Signed-off-by Leon Hwang <[email protected]>

---
  .../selftests/bpf/prog_tests/tailcalls.c      | 48 +++++++++++++++++++
  1 file changed, 48 insertions(+)

tools/testing/selftests/bpf/prog_tests/tailcalls.c +46 -0

index c66037162da5..c5c9d6c359bb 100644
@@ -13,6 +13,8 @@
  #include "tailcall_cgrp_storage.skel.h"
  #include "tailcall_sleepable.skel.h"
  #include "tailcall_callback.skel.h"
+#include "tailcall_bpf2bpf2.skel.h"
+#include "tailcall_bpf2bpf_fexit.skel.h"
 
  /* test_tailcall_1 checks basic functionality by patching multiple locations
   * in a single program for a single tail call slot with nop->jmp, jmp->nop

@@ -1907,6 +1909,50 @@ static void test_tailcall_callback(void)
  	RUN_TESTS(tailcall_callback);
  }
 
+static void test_tailcall_bpf2bpf_fexit_links(void)
+{
+	struct tailcall_bpf2bpf_fexit *skel1 = NULL, *skel2 = NULL;
+	struct tailcall_bpf2bpf2 *skel_tc;
+	int err, prog_fd;
+
+	skel_tc = tailcall_bpf2bpf2__open_and_load();
+	if (!ASSERT_OK_PTR(skel_tc, "tailcall_bpf2bpf2__open_and_load"))
+		return;
+
+	skel1 = tailcall_bpf2bpf_fexit__open();
+	if (!ASSERT_OK_PTR(skel1, "tailcall_bpf2bpf_fexit__open"))
+		goto out;
+
+	prog_fd = bpf_program__fd(skel_tc->progs.classifier_0);
+	err = bpf_program__set_attach_target(skel1->progs.fexit, prog_fd, "subprog_tail");
+	if (!ASSERT_OK(err, "bpf_program__set_attach_target"))
+		goto out;
+
+	err = tailcall_bpf2bpf_fexit__load(skel1);
+	if (!ASSERT_OK(err, "tailcall_bpf2bpf_fexit__load"))
+		goto out;
+
+	skel1->links.fexit = bpf_program__attach_trace(skel1->progs.fexit);
+	if (!ASSERT_OK_PTR(skel1->links.fexit, "bpf_program__attach_trace"))
+		goto out;
+
+	skel2 = tailcall_bpf2bpf_fexit__open();
+	if (!ASSERT_OK_PTR(skel2, "tailcall_bpf2bpf_fexit__open"))
+		goto out;
+
+	err = bpf_program__set_attach_target(skel2->progs.fexit, prog_fd, "subprog_tail");
+	if (!ASSERT_OK(err, "bpf_program__set_attach_target"))
+		goto out;
+
+	err = tailcall_bpf2bpf_fexit__load(skel2);
+	ASSERT_OK(err, "tailcall_bpf2bpf_fexit__load");
+
+out:
+	tailcall_bpf2bpf_fexit__destroy(skel1);
+	tailcall_bpf2bpf_fexit__destroy(skel2);
+	tailcall_bpf2bpf2__destroy(skel_tc);
+}
+
  void test_tailcalls(void)
  {
  	if (test__start_subtest("tailcall_1"))