lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230529154852.584377-1-starmiku1207184332@gmail.com> Date: Mon, 29 May 2023 15:48:52 +0000 From: starmiku1207184332@...il.com To: ast@...nel.org, daniel@...earbox.net, john.fastabend@...il.com, andrii@...nel.org, martin.lau@...ux.dev, song@...nel.org, yhs@...com, kpsingh@...nel.org, sdf@...gle.com, haoluo@...gle.com, jolsa@...nel.org, davem@...emloft.net, kuba@...nel.org, hawk@...nel.org Cc: bpf@...r.kernel.org, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, Teng Qi <starmiku1207184332@...il.com> Subject: [PATCH] kernel: bpf: syscall: fix a possible sleep-in-atomic bug in __bpf_prog_put() From: Teng Qi <starmiku1207184332@...il.com> Although we haven`t found a proper way to identify the rcu read lock region, we have noticed that vfree() calls vfree_atomic() with the condition 'in_interrupt()' to ensure safety. To make __bpf_prog_put() safe in practice, we propose calling bpf_prog_put_deferred() with the condition 'in_interrupt()' and using the work queue for any other context. We also added a comment to indicate that the safety of __bpf_prog_put() relies implicitly on the implementation of vfree(). Signed-off-by: Teng Qi <starmiku1207184332@...il.com> --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 14f39c1e573e..48ff5d2e163a 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2099,10 +2099,12 @@ static void __bpf_prog_put(struct bpf_prog *prog) struct bpf_prog_aux *aux = prog->aux; if (atomic64_dec_and_test(&aux->refcnt)) { - if (in_irq() || irqs_disabled()) { + if (!in_interrupt()) { + // safely calling vfree() under any context INIT_WORK(&aux->work, bpf_prog_put_deferred); schedule_work(&aux->work); } else { + // depending on the vfree_atomic() branch in vfree() bpf_prog_put_deferred(&aux->work); } } -- 2.25.1
Powered by blists - more mailing lists