Patch "bpf: Free struct bpf_cpumask in call_rcu handler" has been added to the 6.3-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Free struct bpf_cpumask in call_rcu handler

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-free-struct-bpf_cpumask-in-call_rcu-handler.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b5b073e6e9486bc9b16ef198269a6eb5ea9c21fa
Author: David Vernet <void@xxxxxxxxxxxxx>
Date:   Thu Mar 16 00:40:24 2023 -0500

    bpf: Free struct bpf_cpumask in call_rcu handler
    
    [ Upstream commit 77473d1a962f3d4f7ba48324502b6d27b8ef2591 ]
    
    The struct bpf_cpumask type uses the bpf_mem_cache_{alloc,free}() APIs
    to allocate and free its cpumasks. The bpf_mem allocator may currently
    immediately reuse some memory when its freed, without waiting for an RCU
    read cycle to elapse. We want to be able to treat struct bpf_cpumask
    objects as completely RCU safe.
    
    This is necessary for two reasons:
    
    1. bpf_cpumask_kptr_get() currently does an RCU-protected
       refcnt_inc_not_zero(). This of course assumes that the underlying
       memory is not reused, and is therefore unsafe in its current form.
    
    2. We want to be able to get rid of bpf_cpumask_kptr_get() entirely, and
       intead use the superior kptr RCU semantics now afforded by the
       verifier.
    
    This patch fixes (1), and enables (2), by making struct bpf_cpumask RCU
    safe. A subsequent patch will update the verifier to allow struct
    bpf_cpumask * pointers to be passed to KF_RCU kfuncs, and then a latter
    patch will remove bpf_cpumask_kptr_get().
    
    Fixes: 516f4d3397c9 ("bpf: Enable cpumasks to be queried and used as kptrs")
    Signed-off-by: David Vernet <void@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230316054028.88924-2-void@xxxxxxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/cpumask.c b/kernel/bpf/cpumask.c
index 2b3fbbfebdc5f..c08132caca33d 100644
--- a/kernel/bpf/cpumask.c
+++ b/kernel/bpf/cpumask.c
@@ -9,6 +9,7 @@
 /**
  * struct bpf_cpumask - refcounted BPF cpumask wrapper structure
  * @cpumask:	The actual cpumask embedded in the struct.
+ * @rcu:	The RCU head used to free the cpumask with RCU safety.
  * @usage:	Object reference counter. When the refcount goes to 0, the
  *		memory is released back to the BPF allocator, which provides
  *		RCU safety.
@@ -24,6 +25,7 @@
  */
 struct bpf_cpumask {
 	cpumask_t cpumask;
+	struct rcu_head rcu;
 	refcount_t usage;
 };
 
@@ -108,6 +110,16 @@ __bpf_kfunc struct bpf_cpumask *bpf_cpumask_kptr_get(struct bpf_cpumask **cpumas
 	return cpumask;
 }
 
+static void cpumask_free_cb(struct rcu_head *head)
+{
+	struct bpf_cpumask *cpumask;
+
+	cpumask = container_of(head, struct bpf_cpumask, rcu);
+	migrate_disable();
+	bpf_mem_cache_free(&bpf_cpumask_ma, cpumask);
+	migrate_enable();
+}
+
 /**
  * bpf_cpumask_release() - Release a previously acquired BPF cpumask.
  * @cpumask: The cpumask being released.
@@ -121,11 +133,8 @@ __bpf_kfunc void bpf_cpumask_release(struct bpf_cpumask *cpumask)
 	if (!cpumask)
 		return;
 
-	if (refcount_dec_and_test(&cpumask->usage)) {
-		migrate_disable();
-		bpf_mem_cache_free(&bpf_cpumask_ma, cpumask);
-		migrate_enable();
-	}
+	if (refcount_dec_and_test(&cpumask->usage))
+		call_rcu(&cpumask->rcu, cpumask_free_cb);
 }
 
 /**