From 6e94583641aaa1587f8db2c079ade0e1bd5c13b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Mon, 23 Sep 2024 20:20:36 +0000 Subject: [PATCH] bpf: promote inet_release hook from V+ 5.10+ to T+ 5.10+ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit will land in M-2025-01 should fix some long standing cookie_tag_map full issues (due to the userspace socket destroy listener code failing to run - likely due to buffer overflow) Bug: 364365891 Test: TreeHugger Signed-off-by: Maciej Żenczykowski Change-Id: If78c335488eadf605a54f20005d9b14fdadb6473 --- bpf/netd/BpfHandler.cpp | 18 +++++++++--------- bpf/progs/netd.c | 4 ++-- bpf/tests/mts/bpf_existence_test.cpp | 12 ++++++------ 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/bpf/netd/BpfHandler.cpp b/bpf/netd/BpfHandler.cpp index 15ab19c41e..5dea851b7f 100644 --- a/bpf/netd/BpfHandler.cpp +++ b/bpf/netd/BpfHandler.cpp @@ -114,6 +114,11 @@ static Status initPrograms(const char* cg2_path) { cg_fd, BPF_CGROUP_INET_SOCK_CREATE)); } + if (bpf::isAtLeastKernelVersion(5, 10, 0)) { + RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_INET_RELEASE_PROG_PATH, + cg_fd, BPF_CGROUP_INET_SOCK_RELEASE)); + } + if (modules::sdklevel::IsAtLeastV()) { RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_CONNECT4_PROG_PATH, cg_fd, BPF_CGROUP_INET4_CONNECT)); @@ -134,11 +139,6 @@ static Status initPrograms(const char* cg2_path) { RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_SETSOCKOPT_PROG_PATH, cg_fd, BPF_CGROUP_SETSOCKOPT)); } - - if (bpf::isAtLeastKernelVersion(5, 10, 0)) { - RETURN_IF_NOT_OK(attachProgramToCgroup(CGROUP_INET_RELEASE_PROG_PATH, - cg_fd, BPF_CGROUP_INET_SOCK_RELEASE)); - } } if (bpf::isAtLeastKernelVersion(4, 19, 0)) { @@ -156,6 +156,10 @@ static Status initPrograms(const char* cg2_path) { if (bpf::queryProgram(cg_fd, BPF_CGROUP_INET6_BIND) <= 0) abort(); } + if (bpf::isAtLeastKernelVersion(5, 10, 0)) { + if (bpf::queryProgram(cg_fd, BPF_CGROUP_INET_SOCK_RELEASE) <= 0) abort(); + } + if (modules::sdklevel::IsAtLeastV()) { if (bpf::queryProgram(cg_fd, BPF_CGROUP_INET4_CONNECT) <= 0) abort(); if (bpf::queryProgram(cg_fd, BPF_CGROUP_INET6_CONNECT) <= 0) abort(); @@ -168,10 +172,6 @@ static Status initPrograms(const char* cg2_path) { if (bpf::queryProgram(cg_fd, BPF_CGROUP_GETSOCKOPT) <= 0) abort(); if (bpf::queryProgram(cg_fd, BPF_CGROUP_SETSOCKOPT) <= 0) abort(); } - - if (bpf::isAtLeastKernelVersion(5, 10, 0)) { - if (bpf::queryProgram(cg_fd, BPF_CGROUP_INET_SOCK_RELEASE) <= 0) abort(); - } } return netdutils::status::ok; diff --git a/bpf/progs/netd.c b/bpf/progs/netd.c index 8804ad569d..cbe856ddce 100644 --- a/bpf/progs/netd.c +++ b/bpf/progs/netd.c @@ -645,8 +645,8 @@ DEFINE_NETD_BPF_PROG_KVER("cgroupsock/inet_create", AID_ROOT, AID_ROOT, inet_soc return (get_app_permissions() & BPF_PERMISSION_INTERNET) ? BPF_ALLOW : BPF_DISALLOW; } -DEFINE_NETD_V_BPF_PROG_KVER("cgroupsockrelease/inet_release", AID_ROOT, AID_ROOT, - inet_socket_release, KVER_5_10) +DEFINE_NETD_BPF_PROG_KVER("cgroupsockrelease/inet_release", AID_ROOT, AID_ROOT, + inet_socket_release, KVER_5_10) (struct bpf_sock* sk) { uint64_t cookie = bpf_get_sk_cookie(sk); if (cookie) bpf_cookie_tag_map_delete_elem(&cookie); diff --git a/bpf/tests/mts/bpf_existence_test.cpp b/bpf/tests/mts/bpf_existence_test.cpp index eaa6373d6c..0b5b7be6df 100644 --- a/bpf/tests/mts/bpf_existence_test.cpp +++ b/bpf/tests/mts/bpf_existence_test.cpp @@ -123,6 +123,11 @@ static const set MAINLINE_FOR_T_4_19_PLUS = { NETD "prog_netd_bind6_inet6_bind", }; +// Provided by *current* mainline module for T+ devices with 5.10+ kernels +static const set MAINLINE_FOR_T_5_10_PLUS = { + NETD "prog_netd_cgroupsockrelease_inet_release", +}; + // Provided by *current* mainline module for T+ devices with 5.15+ kernels static const set MAINLINE_FOR_T_5_15_PLUS = { SHARED "prog_dscpPolicy_schedcls_set_dscp_ether", @@ -154,11 +159,6 @@ static const set MAINLINE_FOR_V_5_4_PLUS = { NETD "prog_netd_setsockopt_prog", }; -// Provided by *current* mainline module for V+ devices with 5.10+ kernels -static const set MAINLINE_FOR_V_5_10_PLUS = { - NETD "prog_netd_cgroupsockrelease_inet_release", -}; - static void addAll(set& a, const set& b) { a.insert(b.begin(), b.end()); } @@ -196,6 +196,7 @@ TEST_F(BpfExistenceTest, TestPrograms) { DO_EXPECT(IsAtLeastT(), MAINLINE_FOR_T_PLUS); DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(4, 14, 0), MAINLINE_FOR_T_4_14_PLUS); DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(4, 19, 0), MAINLINE_FOR_T_4_19_PLUS); + DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_T_5_10_PLUS); DO_EXPECT(IsAtLeastT() && isAtLeastKernelVersion(5, 15, 0), MAINLINE_FOR_T_5_15_PLUS); // U requires Linux Kernel 4.14+, but nothing (as yet) added or removed in U. @@ -207,7 +208,6 @@ TEST_F(BpfExistenceTest, TestPrograms) { if (IsAtLeastV()) ASSERT_TRUE(isAtLeastKernelVersion(4, 19, 0)); DO_EXPECT(IsAtLeastV(), MAINLINE_FOR_V_PLUS); DO_EXPECT(IsAtLeastV() && isAtLeastKernelVersion(5, 4, 0), MAINLINE_FOR_V_5_4_PLUS); - DO_EXPECT(IsAtLeastV() && isAtLeastKernelVersion(5, 10, 0), MAINLINE_FOR_V_5_10_PLUS); for (const auto& file : mustExist) { EXPECT_EQ(0, access(file.c_str(), R_OK)) << file << " does not exist";