Messages in this thread | | | Date | Fri, 20 Oct 2023 22:46:48 +0800 | Subject | Re: [RESEND PATCH bpf-next v6 8/8] selftests/bpf: Add tests for open-coded task and css iter | From | Chuyi Zhou <> |
| |
在 2023/10/20 08:03, Alexei Starovoitov 写道: > On Tue, Oct 17, 2023 at 11:18 PM Chuyi Zhou <zhouchuyi@bytedance.com> wrote: >> >> + >> +SEC("?fentry.s/" SYS_PREFIX "sys_getpgid") >> +__failure __msg("css_task_iter is only allowed in bpf_lsm and bpf iter-s") >> +int BPF_PROG(iter_css_task_for_each) >> +{ >> + u64 cg_id = bpf_get_current_cgroup_id(); >> + struct cgroup *cgrp = bpf_cgroup_from_id(cg_id); >> + struct cgroup_subsys_state *css; >> + struct task_struct *task; >> + >> + if (cgrp == NULL) >> + return 0; >> + css = &cgrp->self; >> + >> + bpf_for_each(css_task, task, css, CSS_TASK_ITER_PROCS) { >> + >> + } >> + bpf_cgroup_release(cgrp); >> + return 0; >> +} > > I think we should relax allowlist in patch 2 further. > Any sleepable is safe. > Allowlist is needed to avoid dead locking on css_set_lock. > Any lsm and any iter (even non-sleepable) and any sleepable > seems to be safe.
Yes, I just try to read the corresponding code. IIUC, the key point here is we should not hold the css_set_lock before we invoking a BPF Prog which may use css_task iters.
1. For lsm hooks and task_iters, it would be clearly know from the code that we would not try to hold that lock.
2. For cgroup_iters, we will hold the cgroup_muetx before we enter the Prog and it's OK.(see __cgroup_procs_write())
3. For any sleepable progs, bpf_check_attach_target() would only allow them to attach some sepecifc hooks, currently, these hooks are OK.
Thanks for the suggestion again! I would do it.
| |