NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/kernel/bpf
History
Marco Elver 301d438e90 bpf_lru_list: Read double-checked variable once without lock 
[ Upstream commit 6df8fb83301d68ea0a0c0e1cbcc790fcc333ed12 ]

For double-checked locking in bpf_common_lru_push_free(), node->type is
read outside the critical section and then re-checked under the lock.
However, concurrent writes to node->type result in data races.

For example, the following concurrent access was observed by KCSAN:

  write to 0xffff88801521bc22 of 1 bytes by task 10038 on cpu 1:
   __bpf_lru_node_move_in        kernel/bpf/bpf_lru_list.c:91
   __local_list_flush            kernel/bpf/bpf_lru_list.c:298
   ...
  read to 0xffff88801521bc22 of 1 bytes by task 10043 on cpu 0:
   bpf_common_lru_push_free      kernel/bpf/bpf_lru_list.c:507
   bpf_lru_push_free             kernel/bpf/bpf_lru_list.c:555
   ...

Fix the data races where node->type is read outside the critical section
(for double-checked locking) by marking the access with READ_ONCE() as
well as ensuring the variable is only accessed once.

Fixes: 3a08c2fd7634 ("bpf: LRU List")
Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
Reported-by: syzbot+516acdb03d3e27d91bcd@syzkaller.appspotmail.com
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210209112701.3341724-1-elver@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-04-12 12:52:15 +08:00
..
Makefile bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE 2021-03-16 16:40:48 +08:00
arraymap.c bpf: Fix bug in mmap() implementation for BPF array map 2021-03-16 16:43:59 +08:00
bpf_lru_list.c bpf_lru_list: Read double-checked variable once without lock 2021-04-12 12:52:15 +08:00
bpf_lru_list.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
btf.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
cgroup.c bpf, cgroup: Fix problematic bounds check 2021-04-12 12:51:52 +08:00
core.c merge bpf_jiffies64 api from 5576b991e9c1a11d2cc21c4b94fc75ec27603896 2021-03-16 16:43:59 +08:00
cpumap.c cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled 2021-03-16 16:27:10 +08:00
devmap.c devmap: Use bpf_map_area_alloc() for allocating hash buckets 2021-03-16 16:30:57 +08:00
disasm.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
disasm.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hashtab.c bpf: Zero-fill re-used per-cpu map element 2021-03-16 16:40:49 +08:00
helpers.c bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback 2021-03-16 16:44:00 +08:00
inode.c bpf: Convert bpf_prog refcnt to atomic64_t 2021-03-16 16:43:58 +08:00
local_storage.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
lpm_trie.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
map_in_map.c bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails 2021-03-16 16:43:58 +08:00
map_in_map.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
offload.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu_freelist.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
percpu_freelist.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
queue_stack_maps.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
reuseport_array.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
stackmap.c bpf: Check for integer overflow when using roundup_pow_of_two() 2021-04-12 12:52:03 +08:00
syscall.c bpf: Prevent mmap()'ing read-only maps as writable 2021-03-16 16:43:59 +08:00
sysfs_btf.c bpf: Fix sysfs export of empty BTF section 2021-03-16 16:37:55 +08:00
tnum.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
verifier.c bpf: Fix truncation handling for mod32 dst reg wrt zero 2021-04-12 12:52:08 +08:00
xskmap.c bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails 2021-03-16 16:43:58 +08:00