Martin KaFai Lau 7c4cd051ad bpf: Fix syscall's stackmap lookup potential deadlock ... The map_lookup_elem used to not acquiring spinlock in order to optimize the reader. It was true until commit 557c0c6e7d ("bpf: convert stackmap to pre-allocation") The syscall's map_lookup_elem(stackmap) calls bpf_stackmap_copy(). bpf_stackmap_copy() may find the elem no longer needed after the copy is done. If that is the case, pcpu_freelist_push() saves this elem for reuse later. This push requires a spinlock. If a tracing bpf_prog got run in the middle of the syscall's map_lookup_elem(stackmap) and this tracing bpf_prog is calling bpf_get_stackid(stackmap) which also requires the same pcpu_freelist's spinlock, it may end up with a dead lock situation as reported by Eric Dumazet in https://patchwork.ozlabs.org/patch/1030266/ The situation is the same as the syscall's map_update_elem() which needs to acquire the pcpu_freelist's spinlock and could race with tracing bpf_prog. Hence, this patch fixes it by protecting bpf_stackmap_copy() with this_cpu_inc(bpf_prog_active) to prevent tracing bpf_prog from running. A later syscall's map_lookup_elem commit f1a2e44a3a ("bpf: add queue and stack maps") also acquires a spinlock and races with tracing bpf_prog similarly. Hence, this patch is forward looking and protects the majority of the map lookups. bpf_map_offload_lookup_elem() is the exception since it is for network bpf_prog only (i.e. never called by tracing bpf_prog). Fixes: 557c0c6e7d ("bpf: convert stackmap to pre-allocation") Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2019-01-31 23:18:21 +01:00
..
Makefile	…
arraymap.c	bpf: pass struct btf pointer to the map_check_btf() callback	2018-12-12 15:33:33 -08:00
bpf_lru_list.c	…
bpf_lru_list.h	…
btf.c	bpf: btf: allow typedef func_proto	2019-01-29 19:15:32 -08:00
cgroup.c	bpf: run bpf programs with preemption disabled	2019-01-31 23:14:55 +01:00
core.c	bpf: enable access to ax register also from verifier rewrite	2019-01-02 16:01:24 -08:00
cpumap.c	bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't	2018-12-20 23:19:12 +01:00
devmap.c	…
disasm.c	…
disasm.h	…
hashtab.c	bpf: fix lockdep false positive in percpu_freelist	2019-01-31 23:18:21 +01:00
helpers.c	…
inode.c	…
local_storage.c	bpf: enable cgroup local storage map pretty print with kind_flag	2018-12-18 01:11:59 +01:00
lpm_trie.c	bpf: pass struct btf pointer to the map_check_btf() callback	2018-12-12 15:33:33 -08:00
map_in_map.c	bpf: fix inner map masking to prevent oob under speculation	2019-01-18 15:19:56 -08:00
map_in_map.h	…
offload.c	…
percpu_freelist.c	bpf: fix lockdep false positive in percpu_freelist	2019-01-31 23:18:21 +01:00
percpu_freelist.h	bpf: fix lockdep false positive in percpu_freelist	2019-01-31 23:18:21 +01:00
queue_stack_maps.c	…
reuseport_array.c	…
stackmap.c	bpf: zero out build_id for BPF_STACK_BUILD_ID_IP	2019-01-17 16:42:35 +01:00
syscall.c	bpf: Fix syscall's stackmap lookup potential deadlock	2019-01-31 23:18:21 +01:00
tnum.c	…
verifier.c	bpf: fix sanitation of alu op with pointer / scalar type from different paths	2019-01-05 21:32:38 -08:00
xskmap.c	…