Commit bdc6d156 authored by Hou Tao's avatar Hou Tao Committed by Pu Lehui
Browse files

bpf: Defer the free of inner map when necessary 

mainline inclusion
from mainline-v6.8-rc1
commit 876673364161da50eed6b472d746ef88242b2368
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VJ
CVE: CVE-2023-52447

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=876673364161



--------------------------------

When updating or deleting an inner map in map array or map htab, the map
may still be accessed by non-sleepable program or sleepable program.
However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map
directly through bpf_map_put(), if the ref-counter is the last one
(which is true for most cases), the inner map will be freed by
ops->map_free() in a kworker. But for now, most .map_free() callbacks
don't use synchronize_rcu() or its variants to wait for the elapse of a
RCU grace period, so after the invocation of ops->map_free completes,
the bpf program which is accessing the inner map may incur
use-after-free problem.

Fix the free of inner map by invoking bpf_map_free_deferred() after both
one RCU grace period and one tasks trace RCU grace period if the inner
map has been removed from the outer map before. The deferment is
accomplished by using call_rcu() or call_rcu_tasks_trace() when
releasing the last ref-counter of bpf map. The newly-added rcu_head
field in bpf_map shares the same storage space with work field to
reduce the size of bpf_map.

Fixes: bba1dc0b ("bpf: Remove redundant synchronize_rcu.")
Fixes: 638e4b82 ("bpf: Allows per-cpu maps and map-in-map in sleepable programs")
Signed-off-by: default avatarHou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20231204140425.1480317-5-houtao@huaweicloud.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Conflicts:
	kernel/bpf/syscall.c
Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
parent 16ea07cb

include/linux/bpf.h

+6 −1
Original line number Diff line number Diff line
@@ -168,6 +168,7 @@ struct bpf_map { 
	u32 btf_vmlinux_value_type_id;

	bool bypass_spec_v1;

	bool frozen; /* write-once; write-protected by freeze_mutex */

	bool free_after_mult_rcu_gp;

	/* 22 bytes hole */



	/* The 3rd and 4th cacheline with misc members to avoid false sharing
@@ -175,7 +176,11 @@ struct bpf_map { 
	 */

	atomic64_t refcnt ____cacheline_aligned;

	atomic64_t usercnt;

	/* rcu is used before freeing and work is only used during freeing */

	union {

		struct work_struct work;

		struct rcu_head rcu;

	};

	struct mutex freeze_mutex;

	atomic64_t writecnt;

};

kernel/bpf/map_in_map.c

+8 −3
Original line number Diff line number Diff line
@@ -102,10 +102,15 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map, 


void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)

{

	/* ptr->ops->map_free() has to go through one

	 * rcu grace period by itself.

	struct bpf_map *inner_map = ptr;



	/* The inner map may still be used by both non-sleepable and sleepable

	 * bpf program, so free it after one RCU grace period and one tasks

	 * trace RCU grace period.

	 */

	bpf_map_put(ptr);

	if (need_defer)

		WRITE_ONCE(inner_map->free_after_mult_rcu_gp, true);

	bpf_map_put(inner_map);

}



u32 bpf_map_fd_sys_lookup_elem(void *ptr)

kernel/bpf/syscall.c

+21 −2
Original line number Diff line number Diff line
@@ -494,6 +494,22 @@ static void bpf_map_put_uref(struct bpf_map *map) 
	}

}



static void bpf_map_free_in_work(struct bpf_map *map)

{

	INIT_WORK(&map->work, bpf_map_free_deferred);

	schedule_work(&map->work);

}



static void bpf_map_free_rcu_gp(struct rcu_head *rcu)

{

	bpf_map_free_in_work(container_of(rcu, struct bpf_map, rcu));

}



static void bpf_map_free_mult_rcu_gp(struct rcu_head *rcu)

{

	call_rcu(rcu, bpf_map_free_rcu_gp);

}



/* decrement map refcnt and schedule it for freeing via workqueue

 * (unrelying map implementation ops->map_free() might sleep)

 */
@@ -503,8 +519,11 @@ static void __bpf_map_put(struct bpf_map *map, bool do_idr_lock) 
		/* bpf_map_free_id() must be called first */

		bpf_map_free_id(map, do_idr_lock);

		btf_put(map->btf);

		INIT_WORK(&map->work, bpf_map_free_deferred);

		schedule_work(&map->work);



		if (READ_ONCE(map->free_after_mult_rcu_gp))

			call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp);

		else

			bpf_map_free_in_work(map);

	}

}