Commit 496f4f1b authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'Don't invoke KPTR_REF destructor on NULL xchg' 



David Vernet says:

====================

When a map value is being freed, we loop over all of the fields of the
corresponding BPF object and issue the appropriate cleanup calls
corresponding to the field's type. If the field is a referenced kptr, we
atomically xchg the value out of the map, and invoke the kptr's
destructor on whatever was there before.

Currently, we always invoke the destructor (or bpf_obj_drop() for a
local kptr) on any kptr, including if no value was xchg'd out of the
map. This means that any function serving as the kptr's KF_RELEASE
destructor must always treat the argument as possibly NULL, and we
invoke unnecessary (and seemingly unsafe) cleanup logic for the local
kptr path as well.

This is an odd requirement -- KF_RELEASE kfuncs that are invoked by BPF
programs do not have this restriction, and the verifier will fail to
load the program if the register containing the to-be-released type has
any untrusted modifiers (e.g. PTR_UNTRUSTED or PTR_MAYBE_NULL). So as to
simplify the expectations required for a KF_RELEASE kfunc, this patch
set updates the KPTR_REF destructor logic to only be invoked when a
non-NULL value is xchg'd out of the map.

Additionally, the patch removes now-unnecessary KF_RELEASE calls from
several kfuncs, and finally, updates the verifier to have KF_RELEASE
automatically imply KF_TRUSTED_ARGS. This restriction was already
implicitly happening because of the aforementioned logic in the verifier
to reject any regs with untrusted modifiers, and to enforce that
KF_RELEASE args are passed with a 0 offset. This change just updates the
behavior to match that of other trusted args. This patch is left to the
end of the series in case it happens to be controversial, as it arguably
is slightly orthogonal to the purpose of the rest of the series.
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 55fbae05 6c831c46

Documentation/bpf/kfuncs.rst

+4 −3
Original line number Diff line number Diff line
@@ -179,9 +179,10 @@ both are orthogonal to each other. 
---------------------



The KF_RELEASE flag is used to indicate that the kfunc releases the pointer

passed in to it. There can be only one referenced pointer that can be passed in.

All copies of the pointer being released are invalidated as a result of invoking

kfunc with this flag.

passed in to it. There can be only one referenced pointer that can be passed

in. All copies of the pointer being released are invalidated as a result of

invoking kfunc with this flag. KF_RELEASE kfuncs automatically receive the

protection afforded by the KF_TRUSTED_ARGS flag described below.



2.4.4 KF_KPTR_GET flag

----------------------

drivers/hid/bpf/hid_bpf_dispatch.c

+0 −3
Original line number Diff line number Diff line
@@ -342,9 +342,6 @@ hid_bpf_release_context(struct hid_bpf_ctx *ctx) 
{

	struct hid_bpf_ctx_kern *ctx_kern;



	if (!ctx)

		return;



	ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx);



	kfree(ctx_kern);

kernel/bpf/cpumask.c

+1 −4
Original line number Diff line number Diff line
@@ -102,9 +102,6 @@ static void cpumask_free_cb(struct rcu_head *head) 
 */

__bpf_kfunc void bpf_cpumask_release(struct bpf_cpumask *cpumask)

{

	if (!cpumask)

		return;



	if (refcount_dec_and_test(&cpumask->usage))

		call_rcu(&cpumask->rcu, cpumask_free_cb);

}
@@ -405,7 +402,7 @@ __diag_pop(); 


BTF_SET8_START(cpumask_kfunc_btf_ids)

BTF_ID_FLAGS(func, bpf_cpumask_create, KF_ACQUIRE | KF_RET_NULL)

BTF_ID_FLAGS(func, bpf_cpumask_release, KF_RELEASE | KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_cpumask_release, KF_RELEASE)

BTF_ID_FLAGS(func, bpf_cpumask_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS)

BTF_ID_FLAGS(func, bpf_cpumask_first, KF_RCU)

BTF_ID_FLAGS(func, bpf_cpumask_first_zero, KF_RCU)

kernel/bpf/helpers.c

+0 −6
Original line number Diff line number Diff line
@@ -2089,9 +2089,6 @@ __bpf_kfunc struct task_struct *bpf_task_kptr_get(struct task_struct **pp) 
 */

__bpf_kfunc void bpf_task_release(struct task_struct *p)

{

	if (!p)

		return;



	put_task_struct(p);

}
@@ -2148,9 +2145,6 @@ __bpf_kfunc struct cgroup *bpf_cgroup_kptr_get(struct cgroup **cgrpp) 
 */

__bpf_kfunc void bpf_cgroup_release(struct cgroup *cgrp)

{

	if (!cgrp)

		return;



	cgroup_put(cgrp);

}

kernel/bpf/syscall.c

+3 −0
Original line number Diff line number Diff line
@@ -677,6 +677,9 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj) 
			break;

		case BPF_KPTR_REF:

			xchgd_field = (void *)xchg((unsigned long *)field_ptr, 0);

			if (!xchgd_field)

				break;



			if (!btf_is_kernel(field->kptr.btf)) {

				pointee_struct_meta = btf_find_struct_meta(field->kptr.btf,

									   field->kptr.btf_id);