forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bpf: add missing rcu protection when releasing programs from prog_array

Browse source 
Normally the program attachment place (like sockets, qdiscs) takes
care of rcu protection and calls bpf_prog_put() after a grace period.
The programs stored inside prog_array may not be attached anywhere,
so prog_array needs to take care of preserving rcu protection.
Otherwise bpf_tail_call() will race with bpf_prog_put().
To solve that introduce bpf_prog_put_rcu() helper function and use
it in 3 places where unattached program can decrement refcnt:
closing program fd, deleting/replacing program in prog_array.

Fixes: 04fd61ab36 ("bpf: allow bpf programs to tail-call other bpf programs")
Reported-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Alexei Starovoitov 2015-05-28 19:26:02 -07:00 • committed by David S. Miller
commit abf2e7d6e2
3 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/linux/bpf.h
View file

@ -123,7 +123,10 @@ struct bpf_prog_aux {
const struct bpf_verifier_ops *ops; const struct bpf_verifier_ops *ops;
struct bpf_map **used_maps; struct bpf_map **used_maps;
struct bpf_prog *prog; struct bpf_prog *prog;
struct work_struct work; union {
struct work_struct work;
struct rcu_head rcu;
};
}; };
struct bpf_array { struct bpf_array {
@ -153,6 +156,7 @@ void bpf_register_map_type(struct bpf_map_type_list *tl);
struct bpf_prog *bpf_prog_get(u32 ufd); struct bpf_prog *bpf_prog_get(u32 ufd);
void bpf_prog_put(struct bpf_prog *prog); void bpf_prog_put(struct bpf_prog *prog);
void bpf_prog_put_rcu(struct bpf_prog *prog);
struct bpf_map *bpf_map_get(struct fd f); struct bpf_map *bpf_map_get(struct fd f);
void bpf_map_put(struct bpf_map *map); void bpf_map_put(struct bpf_map *map);

4
kernel/bpf/arraymap.c
View file

@ -202,7 +202,7 @@ static int prog_array_map_update_elem(struct bpf_map *map, void *key,
old_prog = xchg(array->prog + index, prog); old_prog = xchg(array->prog + index, prog);
if (old_prog) if (old_prog)
bpf_prog_put(old_prog); bpf_prog_put_rcu(old_prog);
return 0; return 0;
} }
@ -218,7 +218,7 @@ static int prog_array_map_delete_elem(struct bpf_map *map, void *key)
old_prog = xchg(array->prog + index, NULL); old_prog = xchg(array->prog + index, NULL);
if (old_prog) { if (old_prog) {
bpf_prog_put(old_prog); bpf_prog_put_rcu(old_prog);
return 0; return 0;
} else { } else {
return -ENOENT; return -ENOENT;

19
kernel/bpf/syscall.c
View file

@ -432,6 +432,23 @@ static void free_used_maps(struct bpf_prog_aux *aux)
kfree(aux->used_maps); kfree(aux->used_maps);
} }
static void __prog_put_rcu(struct rcu_head *rcu)
{
struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
free_used_maps(aux);
bpf_prog_free(aux->prog);
}
/* version of bpf_prog_put() that is called after a grace period */
void bpf_prog_put_rcu(struct bpf_prog *prog)
{
if (atomic_dec_and_test(&prog->aux->refcnt)) {
prog->aux->prog = prog;
call_rcu(&prog->aux->rcu, __prog_put_rcu);
}
}
void bpf_prog_put(struct bpf_prog *prog) void bpf_prog_put(struct bpf_prog *prog)
{ {
if (atomic_dec_and_test(&prog->aux->refcnt)) { if (atomic_dec_and_test(&prog->aux->refcnt)) {
@ -445,7 +462,7 @@ static int bpf_prog_release(struct inode *inode, struct file *filp)
{ {
struct bpf_prog *prog = filp->private_data; struct bpf_prog *prog = filp->private_data;
bpf_prog_put(prog); bpf_prog_put_rcu(prog);
return 0; return 0;
} }