On Mon, Nov 13, 2023 at 7:09 PM Yonghong Song <yonghong.song@xxxxxxxxx> wrote:
>
>
> On 11/12/23 7:59 PM, Hou Tao wrote:
> > Hi,
> >
> > On 11/13/2023 10:34 AM, Yonghong Song wrote:
> >> On 11/10/23 8:38 PM, Hou Tao wrote:
> >>> From: Hou Tao <houtao1@xxxxxxxxxx>
> >>>
> >>> bpf_mem_cache_alloc_flags() may call __alloc() directly when there is no
> >>> free object in free list, but it doesn't initialize the allocation hint
> >>> for the returned pointer. It may lead to bad memory dereference when
> >>> freeing the pointer, so fix it by initializing the allocation hint.
> >>>
> >>> Fixes: 822fb26bdb55 ("bpf: Add a hint to allocated objects.")
> >>> Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
> >> LGTM based on my reading of the code. Maybe you could explain
> >> how you found this issue and whether a test case can be constructed
> >> relatively easily to expose this issue?
> >>
> >> Acked-by: Yonghong Song <yonghong.song@xxxxxxxxx>
> > Thanks for the review. I found the issue through code inspection when
> > trying to use c->unit_size to select the target cache in bpf_mem_free().
> > I think it is hard to trigger the problem under x86-64 or arm64 when
> > PREEMPT_RT is disabled. Because with disabled PREEMPT_RT, irq work is
> > invoked in IPI context and free_llist will be refilled timely and
> > unit_alloc() will always return a free object under normal process
> > context. But when PREEMPT_RT is disabled, irq work is invoked under a
>
> In the above 'when PREEMPT_RT is disable' => 'when PREEMPT_RT is enabled".
>
> What you described makes sense. It is indeed hard to construct a test
> case with current kernel.
Applied. Thanks.
Sorry for the delay.
