From: Hou Tao <houtao1@xxxxxxxxxx> Hi, The patchset aims to fix the release of inner map in map array or map htab. The release of inner map is different with normal map. For normal map, the map is released after the bpf program which uses the map is destroyed, because the bpf program tracks the used maps. However bpf program can not track the used inner map because these inner map may be updated or deleted dynamically, and for now the ref-count of inner map is decreased after the inner map is remove from outer map, so the inner map may be freed before the bpf program, which is accessing the inner map, exits and there will be use-after-free problem as demonstrated by patch #5. The patchset fixes the problem by deferring the release of inner map. The freeing of inner map is deferred according to the sleepable context of the bpf programs which own the outer map. Patch #1 fixes the warning when running the newly-added selftest under interpreter mode. Patch #2 adds more parameters to .map_fd_put_ptr(). Patch #3 fixes the potential use-after-free problem by waiting for one RCU GP and one tasks trace RCU GP unconditionally. Patch #4 optimizes the free of inner map by removing the unnecessary RCU GP waiting and patch #5 add a selftest to demonstrate the potential use-after-free problem. Please see individual patches for more details. And comments are always welcome. Change Log: v2: * defer the invocation of ops->map_free() instead of bpf_map_put() (Martin) * update selftest to make it being reproducible under JIT mode (Martin) * remove unnecessary preparatory patches v1: https://lore.kernel.org/bpf/20231107140702.1891778-1-houtao@xxxxxxxxxxxxxxx Hou Tao (5): bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Defer the free of inner map when necessary bpf: Optimize the free of inner map selftests/bpf: Add test cases for inner map include/linux/bpf.h | 14 +- kernel/bpf/arraymap.c | 12 +- kernel/bpf/hashtab.c | 6 +- kernel/bpf/helpers.c | 13 +- kernel/bpf/map_in_map.c | 21 ++- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 16 ++ kernel/bpf/verifier.c | 5 + .../selftests/bpf/prog_tests/map_in_map.c | 141 ++++++++++++++++++ .../selftests/bpf/progs/access_map_in_map.c | 93 ++++++++++++ 10 files changed, 304 insertions(+), 19 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/map_in_map.c create mode 100644 tools/testing/selftests/bpf/progs/access_map_in_map.c -- 2.29.2
