Commit 5a6b1a20 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'link_detach' 



Andrii Nakryiko says:

====================
This patch set adds new BPF link operation, LINK_DETACH, allowing processes
with BPF link FD to force-detach it from respective BPF hook, similarly how
BPF link is auto-detached when such BPF hook (e.g., cgroup, net_device, netns,
etc) is removed. This facility allows admin to forcefully undo BPF link
attachment, while process that created BPF link in the first place is left
intact.

Once force-detached, BPF link stays valid in the kernel as long as there is at
least one FD open against it. It goes into defunct state, just like
auto-detached BPF link.

bpftool also got `link detach` command to allow triggering this in
non-programmatic fashion.

v1->v2:
- improve error reporting in `bpftool link detach` (Song).
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 4939b284 e85f99aa

include/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -793,6 +793,7 @@ struct bpf_link { 
struct bpf_link_ops {

	void (*release)(struct bpf_link *link);

	void (*dealloc)(struct bpf_link *link);

	int (*detach)(struct bpf_link *link);

	int (*update_prog)(struct bpf_link *link, struct bpf_prog *new_prog,

			   struct bpf_prog *old_prog);

	void (*show_fdinfo)(const struct bpf_link *link, struct seq_file *seq);

include/uapi/linux/bpf.h

+5 −0
Original line number Diff line number Diff line
@@ -117,6 +117,7 @@ enum bpf_cmd { 
	BPF_LINK_GET_NEXT_ID,

	BPF_ENABLE_STATS,

	BPF_ITER_CREATE,

	BPF_LINK_DETACH,

};



enum bpf_map_type {
@@ -634,6 +635,10 @@ union bpf_attr { 
		__u32		old_prog_fd;

	} link_update;



	struct {

		__u32		link_fd;

	} link_detach;



	struct { /* struct used by BPF_ENABLE_STATS command */

		__u32		type;

	} enable_stats;

kernel/bpf/cgroup.c

+14 −1
Original line number Diff line number Diff line
@@ -814,6 +814,7 @@ static void bpf_cgroup_link_release(struct bpf_link *link) 
{

	struct bpf_cgroup_link *cg_link =

		container_of(link, struct bpf_cgroup_link, link);

	struct cgroup *cg;



	/* link might have been auto-detached by dying cgroup already,

	 * in that case our work is done here
@@ -832,8 +833,12 @@ static void bpf_cgroup_link_release(struct bpf_link *link) 
	WARN_ON(__cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link,

				    cg_link->type));



	cg = cg_link->cgroup;

	cg_link->cgroup = NULL;



	mutex_unlock(&cgroup_mutex);

	cgroup_put(cg_link->cgroup);



	cgroup_put(cg);

}



static void bpf_cgroup_link_dealloc(struct bpf_link *link)
@@ -844,6 +849,13 @@ static void bpf_cgroup_link_dealloc(struct bpf_link *link) 
	kfree(cg_link);

}



static int bpf_cgroup_link_detach(struct bpf_link *link)

{

	bpf_cgroup_link_release(link);



	return 0;

}



static void bpf_cgroup_link_show_fdinfo(const struct bpf_link *link,

					struct seq_file *seq)

{
@@ -883,6 +895,7 @@ static int bpf_cgroup_link_fill_link_info(const struct bpf_link *link, 
static const struct bpf_link_ops bpf_cgroup_link_lops = {

	.release = bpf_cgroup_link_release,

	.dealloc = bpf_cgroup_link_dealloc,

	.detach = bpf_cgroup_link_detach,

	.update_prog = cgroup_bpf_replace,

	.show_fdinfo = bpf_cgroup_link_show_fdinfo,

	.fill_link_info = bpf_cgroup_link_fill_link_info,

kernel/bpf/net_namespace.c

+8 −0
Original line number Diff line number Diff line
@@ -142,9 +142,16 @@ static void bpf_netns_link_release(struct bpf_link *link) 
	bpf_prog_array_free(old_array);



out_unlock:

	net_link->net = NULL;

	mutex_unlock(&netns_bpf_mutex);

}



static int bpf_netns_link_detach(struct bpf_link *link)

{

	bpf_netns_link_release(link);

	return 0;

}



static void bpf_netns_link_dealloc(struct bpf_link *link)

{

	struct bpf_netns_link *net_link =
@@ -228,6 +235,7 @@ static void bpf_netns_link_show_fdinfo(const struct bpf_link *link, 
static const struct bpf_link_ops bpf_netns_link_ops = {

	.release = bpf_netns_link_release,

	.dealloc = bpf_netns_link_dealloc,

	.detach = bpf_netns_link_detach,

	.update_prog = bpf_netns_link_update_prog,

	.fill_link_info = bpf_netns_link_fill_info,

	.show_fdinfo = bpf_netns_link_show_fdinfo,

kernel/bpf/syscall.c

+26 −0
Original line number Diff line number Diff line
@@ -3991,6 +3991,29 @@ out_put_link: 
	return ret;

}



#define BPF_LINK_DETACH_LAST_FIELD link_detach.link_fd



static int link_detach(union bpf_attr *attr)

{

	struct bpf_link *link;

	int ret;



	if (CHECK_ATTR(BPF_LINK_DETACH))

		return -EINVAL;



	link = bpf_link_get_from_fd(attr->link_detach.link_fd);

	if (IS_ERR(link))

		return PTR_ERR(link);



	if (link->ops->detach)

		ret = link->ops->detach(link);

	else

		ret = -EOPNOTSUPP;



	bpf_link_put(link);

	return ret;

}



static int bpf_link_inc_not_zero(struct bpf_link *link)

{

	return atomic64_fetch_add_unless(&link->refcnt, 1, 0) ? 0 : -ENOENT;
@@ -4240,6 +4263,9 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz 
	case BPF_ITER_CREATE:

		err = bpf_iter_create(&attr);

		break;

	case BPF_LINK_DETACH:

		err = link_detach(&attr);

		break;

	default:

		err = -EINVAL;

		break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE