Jiri Olsa reported a bug in https://lore.kernel.org/bpf/CAKH8qBuXCfUz=w8L+Fj74OaUpbosO29niYwTki7e3Ag044_aww@xxxxxxxxxxxxxx/T where cgroup local storage pointer may be NULL in bpf_get_local_storage() helper. There are two issues uncovered by this bug: (1). kprobe or tracepoint prog incorrectly sets cgroup local storage before prog run, (2). due to change from preempt_disable to migrate_disable, preemption is possible and percpu storage might be overwritten by other tasks. Issue (1) has been fixed and this patch set fixed issue (2). Please see details of Patch #1 for detailed fix. Patch #2 fixed bpf_prog_test_run to use new signature for bpf_cgroup_storage_set(). Patch #1 can be backported to bpf tree and Patch #2 cannot due to refactoring done in bpf-next only. I did not put a Fix tag as I am not able to find a proper one. The original commit which changed from preempt_disable to migrate_disable in bpf.h is just a wrapper where migrate_disable still calls preempt_disable. The real migrate_disable change happens later in kernel/sched/*. Yonghong Song (2): bpf: fix NULL pointer dereference in bpf_get_local_storage() helper bpf: fix bpf_cgroup_storage_set() usage in test_run include/linux/bpf-cgroup.h | 53 +++++++++++++++++++++++++++++++++----- include/linux/bpf.h | 22 +++++++++++++--- kernel/bpf/helpers.c | 15 ++++++++--- kernel/bpf/local_storage.c | 3 ++- net/bpf/test_run.c | 6 ++++- 5 files changed, 83 insertions(+), 16 deletions(-) -- 2.30.2
