Commit abf2e7d6 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

bpf: add missing rcu protection when releasing programs from prog_array 



Normally the program attachment place (like sockets, qdiscs) takes
care of rcu protection and calls bpf_prog_put() after a grace period.
The programs stored inside prog_array may not be attached anywhere,
so prog_array needs to take care of preserving rcu protection.
Otherwise bpf_tail_call() will race with bpf_prog_put().
To solve that introduce bpf_prog_put_rcu() helper function and use
it in 3 places where unattached program can decrement refcnt:
closing program fd, deleting/replacing program in prog_array.

Fixes: 04fd61ab ("bpf: allow bpf programs to tail-call other bpf programs")
Reported-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d1f5f2bb

include/linux/bpf.h

+5 −1
Original line number Diff line number Diff line
@@ -123,7 +123,10 @@ struct bpf_prog_aux { 
	const struct bpf_verifier_ops *ops;

	struct bpf_map **used_maps;

	struct bpf_prog *prog;

	union {

		struct work_struct work;

		struct rcu_head	rcu;

	};

};



struct bpf_array {
@@ -153,6 +156,7 @@ void bpf_register_map_type(struct bpf_map_type_list *tl); 


struct bpf_prog *bpf_prog_get(u32 ufd);

void bpf_prog_put(struct bpf_prog *prog);

void bpf_prog_put_rcu(struct bpf_prog *prog);



struct bpf_map *bpf_map_get(struct fd f);

void bpf_map_put(struct bpf_map *map);

kernel/bpf/arraymap.c

+2 −2
Original line number Diff line number Diff line
@@ -202,7 +202,7 @@ static int prog_array_map_update_elem(struct bpf_map *map, void *key, 


	old_prog = xchg(array->prog + index, prog);

	if (old_prog)

		bpf_prog_put(old_prog);

		bpf_prog_put_rcu(old_prog);



	return 0;

}
@@ -218,7 +218,7 @@ static int prog_array_map_delete_elem(struct bpf_map *map, void *key) 


	old_prog = xchg(array->prog + index, NULL);

	if (old_prog) {

		bpf_prog_put(old_prog);

		bpf_prog_put_rcu(old_prog);

		return 0;

	} else {

		return -ENOENT;

kernel/bpf/syscall.c

+18 −1
Original line number Diff line number Diff line
@@ -432,6 +432,23 @@ static void free_used_maps(struct bpf_prog_aux *aux) 
	kfree(aux->used_maps);

}



static void __prog_put_rcu(struct rcu_head *rcu)

{

	struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);



	free_used_maps(aux);

	bpf_prog_free(aux->prog);

}



/* version of bpf_prog_put() that is called after a grace period */

void bpf_prog_put_rcu(struct bpf_prog *prog)

{

	if (atomic_dec_and_test(&prog->aux->refcnt)) {

		prog->aux->prog = prog;

		call_rcu(&prog->aux->rcu, __prog_put_rcu);

	}

}



void bpf_prog_put(struct bpf_prog *prog)

{

	if (atomic_dec_and_test(&prog->aux->refcnt)) {
@@ -445,7 +462,7 @@ static int bpf_prog_release(struct inode *inode, struct file *filp) 
{

	struct bpf_prog *prog = filp->private_data;



	bpf_prog_put(prog);

	bpf_prog_put_rcu(prog);

	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE