From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dave Marchevsky <davemarchevsky@fb.com>,
Alexei Starovoitov <ast@kernel.org>,
Sasha Levin <sashal@kernel.org>,
daniel@iogearbox.net, andrii@kernel.org, bpf@vger.kernel.org
Subject: [PATCH AUTOSEL 6.4 41/41] bpf: Consider non-owning refs to refcounted nodes RCU protected
Date: Fri, 8 Sep 2023 14:15:55 -0400 [thread overview]
Message-ID: <20230908181555.3459640-41-sashal@kernel.org> (raw)
In-Reply-To: <20230908181555.3459640-1-sashal@kernel.org>
From: Dave Marchevsky <davemarchevsky@fb.com>
[ Upstream commit 0816b8c6bf7fc87cec4273dc199e8f0764b9e7b1 ]
An earlier patch in the series ensures that the underlying memory of
nodes with bpf_refcount - which can have multiple owners - is not reused
until RCU grace period has elapsed. This prevents
use-after-free with non-owning references that may point to
recently-freed memory. While RCU read lock is held, it's safe to
dereference such a non-owning ref, as by definition RCU GP couldn't have
elapsed and therefore underlying memory couldn't have been reused.
From the perspective of verifier "trustedness" non-owning refs to
refcounted nodes are now trusted only in RCU CS and therefore should no
longer pass is_trusted_reg, but rather is_rcu_reg. Let's mark them
MEM_RCU in order to reflect this new state.
Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Link: https://lore.kernel.org/r/20230821193311.3290257-6-davemarchevsky@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/bpf.h | 3 ++-
kernel/bpf/verifier.c | 13 ++++++++++++-
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 1ad211acf1d25..0646d377dae7f 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -640,7 +640,8 @@ enum bpf_type_flag {
MEM_RCU = BIT(13 + BPF_BASE_TYPE_BITS),
/* Used to tag PTR_TO_BTF_ID | MEM_ALLOC references which are non-owning.
- * Currently only valid for linked-list and rbtree nodes.
+ * Currently only valid for linked-list and rbtree nodes. If the nodes
+ * have a bpf_refcount_field, they must be tagged MEM_RCU as well.
*/
NON_OWN_REF = BIT(14 + BPF_BASE_TYPE_BITS),
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4fbfe1d086467..ad44f64c2dec6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7646,6 +7646,7 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env,
case PTR_TO_BTF_ID | PTR_TRUSTED:
case PTR_TO_BTF_ID | MEM_RCU:
case PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF:
+ case PTR_TO_BTF_ID | MEM_ALLOC | NON_OWN_REF | MEM_RCU:
/* When referenced PTR_TO_BTF_ID is passed to release function,
* its fixed offset must be 0. In the other cases, fixed offset
* can be non-zero. This was already checked above. So pass
@@ -10106,6 +10107,7 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,
static int ref_set_non_owning(struct bpf_verifier_env *env, struct bpf_reg_state *reg)
{
struct bpf_verifier_state *state = env->cur_state;
+ struct btf_record *rec = reg_btf_record(reg);
if (!state->active_lock.ptr) {
verbose(env, "verifier internal error: ref_set_non_owning w/o active lock\n");
@@ -10118,6 +10120,9 @@ static int ref_set_non_owning(struct bpf_verifier_env *env, struct bpf_reg_state
}
reg->type |= NON_OWN_REF;
+ if (rec->refcount_off >= 0)
+ reg->type |= MEM_RCU;
+
return 0;
}
@@ -10936,6 +10941,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
struct bpf_func_state *state;
struct bpf_reg_state *reg;
+ if (in_rbtree_lock_required_cb(env) && (rcu_lock || rcu_unlock)) {
+ verbose(env, "Calling bpf_rcu_read_{lock,unlock} in unnecessary rbtree callback\n");
+ return -EACCES;
+ }
+
if (rcu_lock) {
verbose(env, "nested rcu read lock (kernel function %s)\n", func_name);
return -EINVAL;
@@ -16234,7 +16244,8 @@ static int do_check(struct bpf_verifier_env *env)
return -EINVAL;
}
- if (env->cur_state->active_rcu_lock) {
+ if (env->cur_state->active_rcu_lock &&
+ !in_rbtree_lock_required_cb(env)) {
verbose(env, "bpf_rcu_read_unlock is missing\n");
return -EINVAL;
}
--
2.40.1
prev parent reply other threads:[~2023-09-08 18:21 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-08 18:15 [PATCH AUTOSEL 6.4 01/41] devlink: remove reload failed checks in params get/set callbacks Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 02/41] crypto: lrw,xts - Replace strlcpy with strscpy Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 03/41] regulator: max77857: Add ADI MAX77857/59/MAX77831 Regulator Support Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 04/41] ice: Don't tx before switchdev is fully configured Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 05/41] wifi: ath9k: fix fortify warnings Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 06/41] wifi: ath9k: fix printk specifier Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 07/41] wifi: rtw88: delete timer and free skb queue when unloading Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 08/41] wifi: mwifiex: fix fortify warning Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 09/41] mt76: mt7921: don't assume adequate headroom for SDIO headers Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 10/41] wifi: wil6210: fix fortify warnings Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 11/41] can: sun4i_can: Add acceptance register quirk Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 12/41] can: sun4i_can: Add support for the Allwinner D1 Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 13/41] net: Use sockaddr_storage for getsockopt(SO_PEERNAME) Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 14/41] wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan() Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 15/41] wifi: ath12k: avoid array overflow of hw mode for preferred_hw_mode Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 16/41] net/ipv4: return the real errno instead of -EINVAL Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 17/41] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 18/41] Bluetooth: btusb: Add device 0489:e0f5 as MT7922 device Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 19/41] Bluetooth: btusb: Add a new VID/PID 0489/e0f6 for MT7922 Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 20/41] Bluetooth: btusb: Add new VID/PID 0489/e102 " Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 21/41] Bluetooth: btusb: Add new VID/PID 04ca/3804 " Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 22/41] Bluetooth: Fix hci_suspend_sync crash Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 23/41] Bluetooth: btusb: Add support for another MediaTek 7922 VID/PID Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 24/41] netlink: convert nlk->flags to atomic flags Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 25/41] tpm_tis: Resend command to recover from data transfer errors Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 26/41] mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450 Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 27/41] alx: fix OOB-read compiler warning Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 28/41] wifi: iwlwifi: pcie: avoid a warning in case prepare card failed Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 29/41] wifi: mac80211: check S1G action frame size Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 30/41] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 31/41] wifi: cfg80211: reject auth/assoc to AP with our address Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 32/41] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 33/41] wifi: mac80211: check for station first in client probe Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 34/41] wifi: mac80211_hwsim: drop short frames Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 35/41] libbpf: Free btf_vmlinux when closing bpf_object Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 36/41] wifi: ath12k: Fix memory leak in rx_desc and tx_desc Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 37/41] Bluetooth: btusb: Fix quirks table naming Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 38/41] wifi: ath12k: add check max message length while scanning with extraie Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 39/41] Fix nomenclature for USB and PCI wireless devices Sasha Levin
2023-09-08 18:15 ` [PATCH AUTOSEL 6.4 40/41] bpf: Consider non-owning refs trusted Sasha Levin
2023-09-08 18:15 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230908181555.3459640-41-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davemarchevsky@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).