Merge branch 'dev/fix_ebpf_permissions' into 'main'

klueska · klueska · commit f30a9f4ad113 · 2023-11-18T15:07:33.000Z
Fix device permission check when using cgroupv2

See merge request nvidia/container-toolkit/libnvidia-container!236
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,7 @@
 # NVIDIA Container Toolkit Library and CLI Changelog
 
+* Fix device permission check when using cgroupv2 (fixes #227)
+
 ## 1.14.1
 * Use libelf.so on RPM-based systems due to removed mageia repositories hosting pmake and bmake.
 
diff --git a/src/nvcgo/internal/cgroup/ebpf.go b/src/nvcgo/internal/cgroup/ebpf.go
@@ -136,10 +136,10 @@ func (p *program) appendDevice(dev specs.LinuxDeviceCgroup, labelPrefix string)
 	}
 	if hasAccess {
 		p.insts = append(p.insts,
-			// if (R3 & bpfAccess == 0 /* use R2 as a temp var */) goto next
-			asm.Mov.Reg32(asm.R2, asm.R3),
-			asm.And.Imm32(asm.R2, bpfAccess),
-			asm.JEq.Imm(asm.R2, 0, nextBlockSym),
+			// if (R3 & bpfAccess != R3 /* use R6 as a temp var */) goto next
+			asm.Mov.Reg32(asm.R6, asm.R3),
+			asm.And.Imm32(asm.R6, bpfAccess),
+			asm.JNE.Reg(asm.R6, asm.R3, nextBlockSym),
 		)
 	}
 	if hasMajor {

Original file line number	Diff line number	Diff line change
`@@ -136,10 +136,10 @@ func (p *program) appendDevice(dev specs.LinuxDeviceCgroup, labelPrefix string)`
`136`	`136`	`}`
`137`	`137`	`if hasAccess {`
`138`	`138`	`p.insts = append(p.insts,`
`139`		`- // if (R3 & bpfAccess == 0 /* use R2 as a temp var */) goto next`
`140`		`- asm.Mov.Reg32(asm.R2, asm.R3),`
`141`		`- asm.And.Imm32(asm.R2, bpfAccess),`
`142`		`- asm.JEq.Imm(asm.R2, 0, nextBlockSym),`
	`139`	`+ // if (R3 & bpfAccess != R3 /* use R6 as a temp var */) goto next`
	`140`	`+ asm.Mov.Reg32(asm.R6, asm.R3),`
	`141`	`+ asm.And.Imm32(asm.R6, bpfAccess),`
	`142`	`+ asm.JNE.Reg(asm.R6, asm.R3, nextBlockSym),`
`143`	`143`	`)`
`144`	`144`	`}`
`145`	`145`	`if hasMajor {`