Patch "bpf: hash map, avoid deadlock with suitable hash mask" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: hash map, avoid deadlock with suitable hash mask

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-hash-map-avoid-deadlock-with-suitable-hash-mask.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit db3e423d05b76c2d43e763e79e5273c2988212a7
Author: Tonghao Zhang <tong@xxxxxxxxxxxxx>
Date:   Wed Jan 11 17:29:01 2023 +0800

    bpf: hash map, avoid deadlock with suitable hash mask
    
    [ Upstream commit 9f907439dc80e4a2fcfb949927b36c036468dbb3 ]
    
    The deadlock still may occur while accessed in NMI and non-NMI
    context. Because in NMI, we still may access the same bucket but with
    different map_locked index.
    
    For example, on the same CPU, .max_entries = 2, we update the hash map,
    with key = 4, while running bpf prog in NMI nmi_handle(), to update
    hash map with key = 20, so it will have the same bucket index but have
    different map_locked index.
    
    To fix this issue, using min mask to hash again.
    
    Fixes: 20b6cc34ea74 ("bpf: Avoid hashtab deadlock with map_locked")
    Signed-off-by: Tonghao Zhang <tong@xxxxxxxxxxxxx>
    Cc: Alexei Starovoitov <ast@xxxxxxxxxx>
    Cc: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Cc: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Cc: Martin KaFai Lau <martin.lau@xxxxxxxxx>
    Cc: Song Liu <song@xxxxxxxxxx>
    Cc: Yonghong Song <yhs@xxxxxx>
    Cc: John Fastabend <john.fastabend@xxxxxxxxx>
    Cc: KP Singh <kpsingh@xxxxxxxxxx>
    Cc: Stanislav Fomichev <sdf@xxxxxxxxxx>
    Cc: Hao Luo <haoluo@xxxxxxxxxx>
    Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
    Cc: Hou Tao <houtao1@xxxxxxxxxx>
    Acked-by: Yonghong Song <yhs@xxxxxx>
    Acked-by: Hou Tao <houtao1@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230111092903.92389-1-tong@xxxxxxxxxxxxx
    Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index ea2051a913fb..06461ce9363e 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -143,7 +143,7 @@ static inline int htab_lock_bucket(const struct bpf_htab *htab,
 {
 	unsigned long flags;
 
-	hash = hash & HASHTAB_MAP_LOCK_MASK;
+	hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1);
 
 	preempt_disable();
 	if (unlikely(__this_cpu_inc_return(*(htab->map_locked[hash])) != 1)) {
@@ -162,7 +162,7 @@ static inline void htab_unlock_bucket(const struct bpf_htab *htab,
 				      struct bucket *b, u32 hash,
 				      unsigned long flags)
 {
-	hash = hash & HASHTAB_MAP_LOCK_MASK;
+	hash = hash & min_t(u32, HASHTAB_MAP_LOCK_MASK, htab->n_buckets - 1);
 	raw_spin_unlock_irqrestore(&b->raw_lock, flags);
 	__this_cpu_dec(*(htab->map_locked[hash]));
 	preempt_enable();