Patch "bpf: Invoke __bpf_prog_exit_sleepable_recur() on recursion in kern_sys_bpf()." has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Invoke __bpf_prog_exit_sleepable_recur() on recursion in kern_sys_bpf().

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-invoke-__bpf_prog_exit_sleepable_recur-on-recurs.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e32b6e912c3fb2970b01ed9867406eb001bcc6f5
Author: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
Date:   Wed Aug 30 10:04:04 2023 +0200

    bpf: Invoke __bpf_prog_exit_sleepable_recur() on recursion in kern_sys_bpf().
    
    [ Upstream commit 7645629f7dc88cd777f98970134bf1a54c8d77e3 ]
    
    If __bpf_prog_enter_sleepable_recur() detects recursion then it returns
    0 without undoing rcu_read_lock_trace(), migrate_disable() or
    decrementing the recursion counter. This is fine in the JIT case because
    the JIT code will jump in the 0 case to the end and invoke the matching
    exit trampoline (__bpf_prog_exit_sleepable_recur()).
    
    This is not the case in kern_sys_bpf() which returns directly to the
    caller with an error code.
    
    Add __bpf_prog_exit_sleepable_recur() as clean up in the recursion case.
    
    Fixes: b1d18a7574d0d ("bpf: Extend sys_bpf commands for bpf_syscall programs.")
    Signed-off-by: Sebastian Andrzej Siewior <bigeasy@xxxxxxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230830080405.251926-2-bigeasy@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7afec961c5728..76484137233a3 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -5138,6 +5138,7 @@ int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size)
 		run_ctx.saved_run_ctx = NULL;
 		if (!__bpf_prog_enter_sleepable_recur(prog, &run_ctx)) {
 			/* recursion detected */
+			__bpf_prog_exit_sleepable_recur(prog, 0, &run_ctx);
 			bpf_prog_put(prog);
 			return -EBUSY;
 		}