From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22B67C48BD6 for ; Thu, 27 Jun 2019 00:38:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DF2FC217F9 for ; Thu, 27 Jun 2019 00:38:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561595912; bh=81fKMQ38NzH5NV0slQ0JXYq4ISNqREsR0ilrtEiT4l8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=quHJ4kgY59ien15BHtsczHuNRKhIgkeYg3M53vTMVr3m0Zj2Sd7Pc87mq9hJHt4MU js/0dA7DuaHqxlRW+waPDV2OWXyt60nPzSVhSK3DW9gGXwqMA5pUGqBxyLsk7VY5HM 7Iud5hoNMZzKI9D/J6D0StnfahB/suJToEzp+Gxo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727878AbfF0Aib (ORCPT ); Wed, 26 Jun 2019 20:38:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:42820 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728842AbfF0Aia (ORCPT ); Wed, 26 Jun 2019 20:38:30 -0400 Received: from sasha-vm.mshome.net (unknown [107.242.116.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1AC40205ED; Thu, 27 Jun 2019 00:38:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561595909; bh=81fKMQ38NzH5NV0slQ0JXYq4ISNqREsR0ilrtEiT4l8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WH23sIzp9t6gB3qc/EvsryvkHkCA9mfthBM84hCsUnseq8OnxhesyVSYfp7SVqEEu 6iu670RZvr2vYRa09Ct0fCyanLV4JMsfx+vw4brdm5IRZV8JS1JO3zV1E+TIKZ4pSg GtreY8eKNeFKbSODnw/bs93CiqbFJfUlsI2cMMSc= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Toshiaki Makita , Daniel Borkmann , Sasha Levin , netdev@vger.kernel.org, xdp-newbies@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 42/60] bpf, devmap: Fix premature entry free on destroying map Date: Wed, 26 Jun 2019 20:35:57 -0400 Message-Id: <20190627003616.20767-42-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190627003616.20767-1-sashal@kernel.org> References: <20190627003616.20767-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Toshiaki Makita [ Upstream commit d4dd153d551634683fccf8881f606fa9f3dfa1ef ] dev_map_free() waits for flush_needed bitmap to be empty in order to ensure all flush operations have completed before freeing its entries. However the corresponding clear_bit() was called before using the entries, so the entries could be used after free. All access to the entries needs to be done before clearing the bit. It seems commit a5e2da6e9787 ("bpf: netdev is never null in __dev_map_flush") accidentally changed the clear_bit() and memory access order. Note that the problem happens only in __dev_map_flush(), not in dev_map_flush_old(). dev_map_flush_old() is called only after nulling out the corresponding netdev_map entry, so dev_map_free() never frees the entry thus no such race happens there. Fixes: a5e2da6e9787 ("bpf: netdev is never null in __dev_map_flush") Signed-off-by: Toshiaki Makita Signed-off-by: Daniel Borkmann Signed-off-by: Sasha Levin --- kernel/bpf/devmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 2faad033715f..99353ac28cd4 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -291,10 +291,10 @@ void __dev_map_flush(struct bpf_map *map) if (unlikely(!dev)) continue; - __clear_bit(bit, bitmap); - bq = this_cpu_ptr(dev->bulkq); bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true); + + __clear_bit(bit, bitmap); } } -- 2.20.1