From: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
To: bpf@vger.kernel.org
Cc: alexei.starovoitov@gmail.com, daniel@iogearbox.net,
olsajiri@gmail.com, andrii@kernel.org, yonghong.song@linux.dev,
rjsu26@vt.edu, sairoop@vt.edu,
Siddharth Chintamaneni <sidchintamaneni@vt.edu>,
syzbot+8bdfc2c53fb2b63e1871@syzkaller.appspotmail.com
Subject: [PATCH bpf-next 1/2] Patch to Fix deadlocks in queue and stack maps
Date: Mon, 29 Apr 2024 12:56:57 -0400 [thread overview]
Message-ID: <20240429165658.1305969-1-sidchintamaneni@gmail.com> (raw)
From: Siddharth Chintamaneni <sidchintamaneni@vt.edu>
This patch address a possible deadlock issue in queue and
stack map types.
Deadlock could happen when a nested BPF program
acquires the same lock as the parent BPF program
to perform a write operation on the same map as
the first one. This bug is also reported by
syzbot.
Link: https://lore.kernel.org/lkml/0000000000004c3fc90615f37756@google.com/
Reported-by: syzbot+8bdfc2c53fb2b63e1871@syzkaller.appspotmail.com
Fixes: f1a2e44a3aec ("bpf: add queue and stack maps")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@vt.edu>
---
kernel/bpf/queue_stack_maps.c | 42 +++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c
index d869f51ea93a..4b7df1a53cf2 100644
--- a/kernel/bpf/queue_stack_maps.c
+++ b/kernel/bpf/queue_stack_maps.c
@@ -18,6 +18,7 @@ struct bpf_queue_stack {
raw_spinlock_t lock;
u32 head, tail;
u32 size; /* max_entries + 1 */
+ int __percpu *map_locked;
char elements[] __aligned(8);
};
@@ -78,6 +79,16 @@ static struct bpf_map *queue_stack_map_alloc(union bpf_attr *attr)
qs->size = size;
+ qs->map_locked = bpf_map_alloc_percpu(&qs->map,
+ sizeof(int),
+ sizeof(int),
+ GFP_USER);
+ if (!qs->map_locked) {
+ bpf_map_area_free(qs);
+ return ERR_PTR(-ENOMEM);
+ }
+
+
raw_spin_lock_init(&qs->lock);
return &qs->map;
@@ -98,6 +109,16 @@ static long __queue_map_get(struct bpf_map *map, void *value, bool delete)
int err = 0;
void *ptr;
+ preempt_disable();
+ local_irq_save(flags);
+ if (unlikely(__this_cpu_inc_return(*(qs->map_locked)) != 1)) {
+ __this_cpu_dec(*(qs->map_locked));
+ local_irq_restore(flags);
+ preempt_enable();
+ return -EBUSY;
+ }
+ preempt_enable();
+
if (in_nmi()) {
if (!raw_spin_trylock_irqsave(&qs->lock, flags))
return -EBUSY;
@@ -133,6 +154,17 @@ static long __stack_map_get(struct bpf_map *map, void *value, bool delete)
void *ptr;
u32 index;
+ preempt_disable();
+ local_irq_save(flags);
+ if (unlikely(__this_cpu_inc_return(*(qs->map_locked)) != 1)) {
+ __this_cpu_dec(*(qs->map_locked));
+ local_irq_restore(flags);
+ preempt_enable();
+ return -EBUSY;
+ }
+ preempt_enable();
+
+
if (in_nmi()) {
if (!raw_spin_trylock_irqsave(&qs->lock, flags))
return -EBUSY;
@@ -194,6 +226,16 @@ static long queue_stack_map_push_elem(struct bpf_map *map, void *value,
int err = 0;
void *dst;
+ preempt_disable();
+ local_irq_save(irq_flags);
+ if (unlikely(__this_cpu_inc_return(*(qs->map_locked)) != 1)) {
+ __this_cpu_dec(*(qs->map_locked));
+ local_irq_restore(irq_flags);
+ preempt_enable();
+ return -EBUSY;
+ }
+ preempt_enable();
+
/* BPF_EXIST is used to force making room for a new element in case the
* map is full
*/
--
2.44.0
next reply other threads:[~2024-04-29 16:57 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-29 16:56 Siddharth Chintamaneni [this message]
2024-04-29 16:56 ` [PATCH bpf-next 2/2] Added selftests to check deadlocks in queue and stack map Siddharth Chintamaneni
2024-04-29 17:54 ` Kumar Kartikeya Dwivedi
2024-04-29 18:07 ` Siddharth Chintamaneni
2024-04-29 17:46 ` [PATCH bpf-next 1/2] Patch to Fix deadlocks in queue and stack maps Kumar Kartikeya Dwivedi
2024-04-29 17:51 ` Siddharth Chintamaneni
2024-05-04 12:22 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240429165658.1305969-1-sidchintamaneni@gmail.com \
--to=sidchintamaneni@gmail.com \
--cc=alexei.starovoitov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=olsajiri@gmail.com \
--cc=rjsu26@vt.edu \
--cc=sairoop@vt.edu \
--cc=sidchintamaneni@vt.edu \
--cc=syzbot+8bdfc2c53fb2b63e1871@syzkaller.appspotmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).