Patch "bpf: Add preempt_count_{sub,add} into btf id deny list" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: Add preempt_count_{sub,add} into btf id deny list

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-add-preempt_count_-sub-add-into-btf-id-deny-list.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2c95642ad283cf0e0d1a667dd2eb727f78dd5673
Author: Yafang <laoar.shao@xxxxxxxxx>
Date:   Thu Apr 13 02:52:48 2023 +0000

    bpf: Add preempt_count_{sub,add} into btf id deny list
    
    [ Upstream commit c11bd046485d7bf1ca200db0e7d0bdc4bafdd395 ]
    
    The recursion check in __bpf_prog_enter* and __bpf_prog_exit*
    leave preempt_count_{sub,add} unprotected. When attaching trampoline to
    them we get panic as follows,
    
    [  867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28)
    [  867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI
    [  867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4
    [  867.843100] Call Trace:
    [  867.843101]  <TASK>
    [  867.843104]  asm_exc_int3+0x3a/0x40
    [  867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0
    [  867.843135]  __bpf_prog_enter_recur+0x17/0x90
    [  867.843148]  bpf_trampoline_6442468108_0+0x2e/0x1000
    [  867.843154]  ? preempt_count_sub+0x1/0xa0
    [  867.843157]  preempt_count_sub+0x5/0xa0
    [  867.843159]  ? migrate_enable+0xac/0xf0
    [  867.843164]  __bpf_prog_exit_recur+0x2d/0x40
    [  867.843168]  bpf_trampoline_6442468108_0+0x55/0x1000
    ...
    [  867.843788]  preempt_count_sub+0x5/0xa0
    [  867.843793]  ? migrate_enable+0xac/0xf0
    [  867.843829]  __bpf_prog_exit_recur+0x2d/0x40
    [  867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35)
    [  867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c)
    [  867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec)
    [  867.843842]  bpf_trampoline_6442468108_0+0x55/0x1000
    ...
    
    That is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are
    called after prog->active is decreased.
    
    Fixing this by adding these two functions into btf ids deny list.
    
    Suggested-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
    Signed-off-by: Yafang <laoar.shao@xxxxxxxxx>
    Cc: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
    Cc: Steven Rostedt <rostedt@xxxxxxxxxxx>
    Cc: Jiri Olsa <olsajiri@xxxxxxxxx>
    Acked-by: Hao Luo <haoluo@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230413025248.79764-1-laoar.shao@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8726161076134..322a2ae8f88b0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15133,6 +15133,10 @@ BTF_ID(func, migrate_enable)
 #if !defined CONFIG_PREEMPT_RCU && !defined CONFIG_TINY_RCU
 BTF_ID(func, rcu_read_unlock_strict)
 #endif
+#if defined(CONFIG_DEBUG_PREEMPT) || defined(CONFIG_TRACE_PREEMPT_TOGGLE)
+BTF_ID(func, preempt_count_add)
+BTF_ID(func, preempt_count_sub)
+#endif
 BTF_SET_END(btf_id_deny)
 
 static int check_attach_btf_id(struct bpf_verifier_env *env)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux