Normally the program attachment place (like sockets, qdiscs) takes
care of rcu protection and calls bpf_prog_put() after a grace period.
The programs stored inside prog_array may not be attached anywhere,
so prog_array needs to take care of preserving rcu protection.
Otherwise bpf_tail_call() will race with bpf_prog_put().
To solve that introduce bpf_prog_put_rcu() helper function and use
it in 3 places where unattached program can decrement refcnt:
closing program fd, deleting/replacing program in prog_array.
Fixes:
|
||
|---|---|---|
| .. | ||
| arraymap.c | ||
| core.c | ||
| hashtab.c | ||
| helpers.c | ||
| Makefile | ||
| syscall.c | ||
| verifier.c | ||