qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bpf: Only invoke kptr dtor following non-NULL xchg 

Bugzilla: https://bugzilla.redhat.com/2221599

commit 1431d0b584a673ea690c88a5f7e1aedd9caf0e84
Author: David Vernet <void@manifault.com>
Date:   Sat Mar 25 16:31:42 2023 -0500

    bpf: Only invoke kptr dtor following non-NULL xchg
    
    When a map value is being freed, we loop over all of the fields of the
    corresponding BPF object and issue the appropriate cleanup calls
    corresponding to the field's type. If the field is a referenced kptr, we
    atomically xchg the value out of the map, and invoke the kptr's
    destructor on whatever was there before (or bpf_obj_drop() it if it was
    a local kptr).
    
    Currently, we always invoke the destructor (either bpf_obj_drop() or the
    kptr's registered destructor) on any KPTR_REF-type field in a map, even
    if there wasn't a value in the map. This means that any function serving
    as the kptr's KF_RELEASE destructor must always treat the argument as
    possibly NULL, as the following can and regularly does happen:
    
    void *xchgd_field;
    
    /* No value was in the map, so xchgd_field is NULL */
    xchgd_field = (void *)xchg(unsigned long *field_ptr, 0);
    field->kptr.dtor(xchgd_field);
    
    These are odd semantics to impose on KF_RELEASE kfuncs -- BPF programs
    are prohibited by the verifier from passing NULL pointers to KF_RELEASE
    kfuncs, so it doesn't make sense to require this of BPF programs, but
    not the main kernel destructor path. It's also unnecessary to invoke any
    cleanup logic for local kptrs. If there is no object there, there's
    nothing to drop.
    
    So as to allow KF_RELEASE kfuncs to fully assume that an argument is
    non-NULL, this patch updates a KPTR_REF's destructor to only be invoked
    when a non-NULL value is xchg'd out of the kptr map field.
    
    Signed-off-by: David Vernet <void@manifault.com>
    Link: https://lore.kernel.org/r/20230325213144.486885-2-void@manifault.com
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Signed-off-by: Artem Savkov <asavkov@redhat.com>
This commit is contained in:
Artem Savkov 2023-07-10 15:58:51 +02:00
parent 54175d4877
commit f54944e86a
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
kernel/bpf/syscall.c
View File

@ -695,6 +695,9 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj)
break;
case BPF_KPTR_REF:
xchgd_field = (void *)xchg((unsigned long *)field_ptr, 0);
if (!xchgd_field)
break;
if (!btf_is_kernel(field->kptr.btf)) {
pointee_struct_meta = btf_find_struct_meta(field->kptr.btf,
field->kptr.btf_id);