Files
linux/include/linux
Jiri Olsa 13578b4ea4 bpf: Fix prog_array_map_poke_run map poke update
commit 4b7de801606e504e69689df71475d27e35336fb3 upstream.

Lee pointed out issue found by syscaller [0] hitting BUG in prog array
map poke update in prog_array_map_poke_run function due to error value
returned from bpf_arch_text_poke function.

There's race window where bpf_arch_text_poke can fail due to missing
bpf program kallsym symbols, which is accounted for with check for
-EINVAL in that BUG_ON call.

The problem is that in such case we won't update the tail call jump
and cause imbalance for the next tail call update check which will
fail with -EBUSY in bpf_arch_text_poke.

I'm hitting following race during the program load:

  CPU 0                             CPU 1

  bpf_prog_load
    bpf_check
      do_misc_fixups
        prog_array_map_poke_track

                                    map_update_elem
                                      bpf_fd_array_map_update_elem
                                        prog_array_map_poke_run

                                          bpf_arch_text_poke returns -EINVAL

    bpf_prog_kallsyms_add

After bpf_arch_text_poke (CPU 1) fails to update the tail call jump, the next
poke update fails on expected jump instruction check in bpf_arch_text_poke
with -EBUSY and triggers the BUG_ON in prog_array_map_poke_run.

Similar race exists on the program unload.

Fixing this by moving the update to bpf_arch_poke_desc_update function which
makes sure we call __bpf_arch_text_poke that skips the bpf address check.

Each architecture has slightly different approach wrt looking up bpf address
in bpf_arch_text_poke, so instead of splitting the function or adding new
'checkip' argument in previous version, it seems best to move the whole
map_poke_run update as arch specific code.

  [0] https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810

Fixes: ebf7d1f508 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Reported-by: syzbot+97a4fe20470e9bc30810@syzkaller.appspotmail.com
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Cc: Lee Jones <lee@kernel.org>
Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/bpf/20231206083041.1306660-2-jolsa@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-05 15:13:40 +01:00
..
2023-07-23 13:46:54 +02:00
2021-07-21 19:54:21 -07:00
2021-02-02 00:16:57 +01:00
2023-11-08 17:26:42 +01:00
2021-09-20 12:43:34 +01:00
2021-01-23 14:57:21 +01:00
2021-08-29 14:47:42 +03:00
2022-08-17 14:23:11 +02:00
2021-05-06 19:24:11 -07:00
2021-04-14 16:30:30 +03:00
2022-10-26 12:35:12 +02:00
2022-08-31 17:16:34 +02:00
2021-05-24 21:13:05 -07:00
2021-08-16 10:50:32 -06:00
2021-01-24 14:27:17 +01:00
2021-02-26 09:41:03 -08:00
2021-04-08 16:04:20 -07:00
2021-01-21 14:06:00 -07:00
2023-12-20 15:17:37 +01:00
2021-08-26 16:52:03 -07:00
2021-12-14 10:57:11 +01:00
2021-11-25 09:48:41 +01:00
2021-07-20 09:20:49 -07:00
2021-09-07 21:17:28 +02:00
2021-03-22 03:57:39 +01:00
2023-03-30 12:47:50 +02:00
2021-08-26 15:32:28 -04:00
2020-12-10 12:42:59 -06:00
2021-07-27 11:00:36 +02:00
2021-09-06 07:20:56 -04:00
2021-04-12 15:04:23 +02:00
2020-11-16 16:31:41 +01:00
2023-12-08 08:48:04 +01:00
2021-06-25 19:57:01 -04:00
2021-07-26 15:09:44 +02:00
2021-07-27 20:11:45 +01:00
2021-07-27 20:11:44 +01:00
2020-07-24 17:12:41 -07:00
2021-02-11 13:24:44 -08:00
2021-08-05 11:46:42 +01:00
2020-08-04 21:02:38 -04:00
2020-12-02 22:10:35 -08:00
2021-04-30 11:20:40 -07:00
2020-11-23 14:16:55 +00:00
2022-10-26 12:35:26 +02:00
2020-09-16 08:54:53 -05:00
2020-11-24 16:47:48 +01:00
2021-07-27 17:05:06 +01:00
2021-07-27 09:29:15 +02:00
2021-01-21 16:16:10 +00:00
2022-08-17 14:24:08 +02:00
2021-06-01 10:29:21 +01:00
2021-02-26 09:41:03 -08:00
2020-09-04 09:25:20 -07:00
2022-07-12 16:35:08 +02:00
2021-05-12 20:11:17 +02:00
2021-06-17 13:09:27 -04:00
2021-06-29 10:53:53 -07:00
2021-07-01 11:06:05 -07:00
2023-11-20 11:08:16 +01:00
2023-06-21 15:59:15 +02:00
2023-08-26 14:23:39 +02:00
2021-09-17 13:52:17 +01:00
2021-02-26 09:40:59 -08:00
2021-02-03 19:05:50 +01:00
2021-06-16 17:20:40 -05:00
2021-07-06 10:37:46 -05:00
2020-08-31 12:52:33 -07:00
2021-06-07 14:11:47 -07:00
2022-07-02 16:41:17 +02:00
2021-08-18 22:08:24 +02:00
2023-11-28 16:56:21 +00:00
2021-10-07 16:51:57 +02:00
2023-10-19 23:05:33 +02:00
2023-10-19 23:05:33 +02:00
2020-12-03 11:20:52 +01:00
2021-01-16 23:19:26 +01:00
2021-08-17 17:50:51 +02:00
2021-03-18 12:58:27 -04:00
2022-07-12 16:35:08 +02:00
2020-12-10 16:17:15 +01:00
2020-12-10 10:45:36 +01:00
2021-05-10 16:03:35 -07:00
2021-08-06 13:41:48 -07:00
2021-08-19 09:02:55 +09:00
2021-06-24 15:49:32 +02:00
2023-12-13 18:36:35 +01:00
2021-07-01 11:06:03 -07:00
2020-10-30 21:57:04 +01:00
2021-07-27 12:17:21 +02:00
2022-07-29 17:25:32 +02:00
2021-07-27 12:12:08 +02:00
2021-02-13 17:17:53 +01:00
2022-09-15 11:30:05 +02:00
2020-11-09 18:39:36 +01:00
2020-09-10 14:03:31 -07:00
2020-08-19 14:13:20 +02:00
2021-01-21 16:16:10 +00:00
2021-02-09 12:15:07 +01:00
2021-08-11 06:44:24 -04:00
2021-01-21 14:06:00 -07:00
2021-03-30 13:42:33 -04:00
2021-01-24 14:27:17 +01:00
2021-02-08 22:58:55 +01:00