[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20241025190854.3030636-1-jrife@google.com>
Date: Fri, 25 Oct 2024 19:08:54 +0000
From: Jordan Rife <jrife@...gle.com>
To: mathieu.desnoyers@...icios.com
Cc: acme@...nel.org, alexander.shishkin@...ux.intel.com,
andrii.nakryiko@...il.com, ast@...nel.org, bpf@...r.kernel.org,
joel@...lfernandes.org, jrife@...gle.com, linux-kernel@...r.kernel.org,
mark.rutland@....com, mhiramat@...nel.org, mingo@...hat.com,
mjeanson@...icios.com, namhyung@...nel.org, paulmck@...nel.org,
peterz@...radead.org, rostedt@...dmis.org,
syzbot+b390c8062d8387b6272a@...kaller.appspotmail.com, yhs@...com
Subject: Re: [RFC PATCH v1] tracing: Fix syscall tracepoint use-after-free
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 59de664e580d..1191dc1d4206 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -3006,14 +3006,21 @@ static void bpf_link_free(struct bpf_link *link)
> bpf_prog_put(link->prog);
I think we would need the same treatment with bpf_prog_put here.
Something like,
tracepoint_call_rcu(raw_tp->btp->tp, &link->prog->aux->rcu,
bpf_link_defer_bpf_prog_put);
static void bpf_link_defer_bpf_prog_put(struct rcu_head *rcu)
{
struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
bpf_prog_put(aux->prox);
}
Alternatively, some context would need to be passed down to
__bpf_prog_put_noref via the call to bpf_prog_put so it can choose
whether or not to use call_rcu or call_rcu_tasks_trace.
> -static inline void release_probes(struct tracepoint_func *old)
> +static bool tracepoint_is_syscall(struct tracepoint *tp)
> +{
> + return !strcmp(tp->name, "sys_enter") || !strcmp(tp->name, "sys_exit");
> +}
I'm curious if it might be better to add some field to struct
tracepoint like "sleepable" rather than adding a special case here
based on the name? Of course, if it's only ever going to be these
two cases then maybe adding a new field doesn't make sense.
-Jordan
Powered by blists - more mailing lists