Patch "bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-bpf_sk_storage-fix-the-missing-uncharge-in-sk_om.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 479473ee1f2ad31c7f6b057de6664b75da16c456
Author: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
Date:   Fri Sep 1 16:11:28 2023 -0700

    bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc
    
    [ Upstream commit 55d49f750b1cb1f177fb1b00ae02cba4613bcfb7 ]
    
    The commit c83597fa5dc6 ("bpf: Refactor some inode/task/sk storage functions
    for reuse"), refactored the bpf_{sk,task,inode}_storage_free() into
    bpf_local_storage_unlink_nolock() which then later renamed to
    bpf_local_storage_destroy(). The commit accidentally passed the
    "bool uncharge_mem = false" argument to bpf_selem_unlink_storage_nolock()
    which then stopped the uncharge from happening to the sk->sk_omem_alloc.
    
    This missing uncharge only happens when the sk is going away (during
    __sk_destruct).
    
    This patch fixes it by always passing "uncharge_mem = true". It is a
    noop to the task/inode/cgroup storage because they do not have the
    map_local_storage_(un)charge enabled in the map_ops. A followup patch
    will be done in bpf-next to remove the uncharge_mem argument.
    
    A selftest is added in the next patch.
    
    Fixes: c83597fa5dc6 ("bpf: Refactor some inode/task/sk storage functions for reuse")
    Signed-off-by: Martin KaFai Lau <martin.lau@xxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230901231129.578493-3-martin.lau@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c
index 37ad47d52dc55..146824cc96893 100644
--- a/kernel/bpf/bpf_local_storage.c
+++ b/kernel/bpf/bpf_local_storage.c
@@ -760,7 +760,7 @@ void bpf_local_storage_destroy(struct bpf_local_storage *local_storage)
 		 * of the loop will set the free_cgroup_storage to true.
 		 */
 		free_storage = bpf_selem_unlink_storage_nolock(
-			local_storage, selem, false, true);
+			local_storage, selem, true, true);
 	}
 	raw_spin_unlock_irqrestore(&local_storage->lock, flags);