Patch "bpf: Fix race between btf_put and btf_idr walk." has been added to the 6.3-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: Fix race between btf_put and btf_idr walk.

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-race-between-btf_put-and-btf_idr-walk.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9531bae44e765a35189235e59a21289ca2e86eed
Author: Alexei Starovoitov <ast@xxxxxxxxxx>
Date:   Thu Apr 20 18:49:01 2023 -0700

    bpf: Fix race between btf_put and btf_idr walk.
    
    [ Upstream commit acf1c3d68e9a31f10d92bc67ad4673cdae5e8d92 ]
    
    Florian and Eduard reported hard dead lock:
    [   58.433327]  _raw_spin_lock_irqsave+0x40/0x50
    [   58.433334]  btf_put+0x43/0x90
    [   58.433338]  bpf_find_btf_id+0x157/0x240
    [   58.433353]  btf_parse_fields+0x921/0x11c0
    
    This happens since btf->refcount can be 1 at the time of btf_put() and
    btf_put() will call btf_free_id() which will try to grab btf_idr_lock
    and will dead lock.
    Avoid the issue by doing btf_put() without locking.
    
    Fixes: 3d78417b60fb ("bpf: Add bpf_btf_find_by_name_kind() helper.")
    Fixes: 1e89106da253 ("bpf: Add bpf_core_add_cands() and wire it into bpf_core_apply_relo_insn().")
    Reported-by: Florian Westphal <fw@xxxxxxxxx>
    Reported-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Tested-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230421014901.70908-1-alexei.starovoitov@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 3140a7881665d..46bce5577fb48 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -572,8 +572,8 @@ static s32 bpf_find_btf_id(const char *name, u32 kind, struct btf **btf_p)
 			*btf_p = btf;
 			return ret;
 		}
-		spin_lock_bh(&btf_idr_lock);
 		btf_put(btf);
+		spin_lock_bh(&btf_idr_lock);
 	}
 	spin_unlock_bh(&btf_idr_lock);
 	return ret;
@@ -8245,12 +8245,10 @@ bpf_core_find_cands(struct bpf_core_ctx *ctx, u32 local_type_id)
 		btf_get(mod_btf);
 		spin_unlock_bh(&btf_idr_lock);
 		cands = bpf_core_add_cands(cands, mod_btf, btf_nr_types(main_btf));
-		if (IS_ERR(cands)) {
-			btf_put(mod_btf);
+		btf_put(mod_btf);
+		if (IS_ERR(cands))
 			return ERR_CAST(cands);
-		}
 		spin_lock_bh(&btf_idr_lock);
-		btf_put(mod_btf);
 	}
 	spin_unlock_bh(&btf_idr_lock);
 	/* cands is a pointer to kmalloced memory here if cands->cnt > 0



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux