| Message ID | 20230830080405.251926-2-bigeasy@linutronix.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 7645629f7dc88cd777f98970134bf1a54c8d77e3 |
| Delegated to: | BPF |
| Headers | show |
| Series | bpf: Recursion detection related fixes. | expand |
On Wed, Aug 30, 2023 at 10:04:04AM +0200, Sebastian Andrzej Siewior wrote: > If __bpf_prog_enter_sleepable_recur() detects recursion then it returns > 0 without undoing rcu_read_lock_trace(), migrate_disable() or > decrementing the recursion counter. This is fine in the JIT case because > the JIT code will jump in the 0 case to the end and invoke the matching > exit trampoline (__bpf_prog_exit_sleepable_recur()). > > This is not the case in kern_sys_bpf() which returns directly to the > caller with an error code. > > Add __bpf_prog_exit_sleepable_recur() as clean up in the recursion case. > > Fixes: b1d18a7574d0d ("bpf: Extend sys_bpf commands for bpf_syscall programs.") > Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Acked-by: Jiri Olsa <jolsa@kernel.org> jirka > --- > kernel/bpf/syscall.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index a2aef900519c2..c925c270ed8b4 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -5307,6 +5307,7 @@ int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size) > run_ctx.saved_run_ctx = NULL; > if (!__bpf_prog_enter_sleepable_recur(prog, &run_ctx)) { > /* recursion detected */ > + __bpf_prog_exit_sleepable_recur(prog, 0, &run_ctx); > bpf_prog_put(prog); > return -EBUSY; > } > -- > 2.40.1 >
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index a2aef900519c2..c925c270ed8b4 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -5307,6 +5307,7 @@ int kern_sys_bpf(int cmd, union bpf_attr *attr, unsigned int size) run_ctx.saved_run_ctx = NULL; if (!__bpf_prog_enter_sleepable_recur(prog, &run_ctx)) { /* recursion detected */ + __bpf_prog_exit_sleepable_recur(prog, 0, &run_ctx); bpf_prog_put(prog); return -EBUSY; }
If __bpf_prog_enter_sleepable_recur() detects recursion then it returns 0 without undoing rcu_read_lock_trace(), migrate_disable() or decrementing the recursion counter. This is fine in the JIT case because the JIT code will jump in the 0 case to the end and invoke the matching exit trampoline (__bpf_prog_exit_sleepable_recur()). This is not the case in kern_sys_bpf() which returns directly to the caller with an error code. Add __bpf_prog_exit_sleepable_recur() as clean up in the recursion case. Fixes: b1d18a7574d0d ("bpf: Extend sys_bpf commands for bpf_syscall programs.") Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> --- kernel/bpf/syscall.c | 1 + 1 file changed, 1 insertion(+)