On Fri, Dec 6, 2024 at 9:09 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > On Wed, Oct 23, 2024 at 09:01:02AM -0700, Andrii Nakryiko wrote: > > On Wed, Oct 23, 2024 at 3:01 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote: > > > > > > Peter reported that perf_event_detach_bpf_prog might skip to release > > > the bpf program for -ENOENT error from bpf_prog_array_copy. > > > > > > This can't happen because bpf program is stored in perf event and is > > > detached and released only when perf event is freed. > > > > > > Let's make it obvious and add WARN_ON_ONCE on the -ENOENT check and > > > make sure the bpf program is released in any case. > > > > > > Cc: Sean Young <sean@xxxxxxxx> > > > Fixes: 170a7e3ea070 ("bpf: bpf_prog_array_copy() should return -ENOENT if exclude_prog not found") > > > Closes: https://lore.kernel.org/lkml/20241022111638.GC16066@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/ > > > Reported-by: Peter Zijlstra <peterz@xxxxxxxxxxxxx> > > > Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx> > > > --- > > > kernel/trace/bpf_trace.c | 5 +++-- > > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > > > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c > > > index 95b6b3b16bac..2c064ba7b0bd 100644 > > > --- a/kernel/trace/bpf_trace.c > > > +++ b/kernel/trace/bpf_trace.c > > > @@ -2216,8 +2216,8 @@ void perf_event_detach_bpf_prog(struct perf_event *event) > > > > > > old_array = bpf_event_rcu_dereference(event->tp_event->prog_array); > > > ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array); > > > - if (ret == -ENOENT) > > > - goto unlock; > > > + if (WARN_ON_ONCE(ret == -ENOENT)) > > > + goto put; > > > if (ret < 0) { > > > bpf_prog_array_delete_safe(old_array, event->prog); > > > > seeing > > > > if (ret < 0) > > bpf_prog_array_delete_safe(old_array, event->prog); > > > > I think neither ret == -ENOENT nor WARN_ON_ONCE is necessary, tbh. So > > now I feel like just dropping WARN_ON_ONCE() is better. > > hi, > there's syzbot report [1] where we could end up with following > > - create perf event and set bpf program to it > - clone process -> create inherited event > - exit -> release both events > - first perf_event_detach_bpf_prog call will release tp_event->prog_array > and second perf_event_detach_bpf_prog will crash because > tp_event->prog_array is NULL > > we can fix that quicly with change below, I guess we could add refcount > to bpf_prog_array_item and allow one of the parent/inherited events to > work while the other is gone.. but that might be too much, will check > > jirka > > > [1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc95e896a7ef9ff93b0b8ad > --- > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c > index fe57dfbf2a86..d4b45543ebc2 100644 > --- a/kernel/trace/bpf_trace.c > +++ b/kernel/trace/bpf_trace.c > @@ -2251,6 +2251,8 @@ void perf_event_detach_bpf_prog(struct perf_event *event) > goto unlock; > > old_array = bpf_event_rcu_dereference(event->tp_event->prog_array); > + if (!old_array) > + goto put; How does this inherited event stuff work? You can have two separate events sharing the same prog_array? What if we attach different programs to each of those events, will both of them be called for either of two events? That sounds broken, if that's true. > ret = bpf_prog_array_copy(old_array, event->prog, NULL, 0, &new_array); > if (ret < 0) { > bpf_prog_array_delete_safe(old_array, event->prog); > @@ -2259,6 +2261,7 @@ void perf_event_detach_bpf_prog(struct perf_event *event) > bpf_prog_array_free_sleepable(old_array); > } > > +put: > bpf_prog_put(event->prog); > event->prog = NULL; >