Dave Marchevsky 7e26cd12ad bpf: Use bpf_mem_free_rcu when bpf_obj_dropping refcounted nodes ... This is the final fix for the use-after-free scenario described in commit 7793fc3bab ("bpf: Make bpf_refcount_acquire fallible for non-owning refs"). That commit, by virtue of changing bpf_refcount_acquire's refcount_inc to a refcount_inc_not_zero, fixed the "refcount incr on 0" splat. The not_zero check in refcount_inc_not_zero, though, still occurs on memory that could have been free'd and reused, so the commit didn't properly fix the root cause. This patch actually fixes the issue by free'ing using the recently-added bpf_mem_free_rcu, which ensures that the memory is not reused until RCU grace period has elapsed. If that has happened then there are no non-owning references alive that point to the recently-free'd memory, so it can be safely reused. Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20230821193311.3290257-4-davemarchevsky@fb.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2023-08-25 09:23:16 -07:00
..
preload	bpf: make preloaded map iterators to display map elements count	2023-07-06 12:42:25 -07:00
arraymap.c	bpf: return long from bpf_map_ops funcs	2023-03-22 15:11:30 -07:00
bloom_filter.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
bpf_cgrp_storage.c	bpf: Teach verifier that certain helpers accept NULL pointer.	2023-04-04 16:57:16 -07:00
bpf_inode_storage.c	Networking changes for 6.4.	2023-04-26 16:07:23 -07:00
bpf_iter.c	bpf: implement numbers iterator	2023-03-08 16:19:51 -08:00
bpf_local_storage.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
bpf_lru_list.c	bpf: Address KCSAN report on bpf_lru_list	2023-05-12 12:01:03 -07:00
bpf_lru_list.h	bpf: lru: Remove unused declaration bpf_lru_promote()	2023-08-08 17:21:42 -07:00
bpf_lsm.c	bpf: Fix the kernel crash caused by bpf_setsockopt().	2023-01-26 23:26:40 -08:00
bpf_struct_ops_types.h	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpf_struct_ops.c	bpf: Support default .validate() and .update() behavior for struct_ops links	2023-08-14 22:23:39 -07:00
bpf_task_storage.c	bpf: Teach verifier that certain helpers accept NULL pointer.	2023-04-04 16:57:16 -07:00
btf.c	net: invert the netdevice.h vs xdp.h dependency	2023-08-03 08:38:07 -07:00
cgroup_iter.c	cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers	2023-03-17 12:07:13 -10:00
cgroup.c	bpf-next-for-netdev	2023-05-16 19:50:05 -07:00
core.c	bpf: fix bpf_probe_read_kernel prototype mismatch	2023-08-02 14:14:17 -07:00
cpumap.c	bpf, cpumask: Clean up bpf_cpu_map_entry directly in cpu_map_free	2023-08-21 15:21:16 -07:00
cpumask.c	bpf: Convert bpf_cpumask to bpf_mem_cache_free_rcu.	2023-07-12 23:45:23 +02:00
devmap.c	bpf, devmap: Remove unused dtab field from bpf_dtab_netdev	2023-07-31 18:26:08 -07:00
disasm.c	bpf: change bpf_alu_sign_string and bpf_movsx_string to static	2023-08-04 16:15:50 -07:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c	bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func	2022-12-14 12:02:14 -08:00
hashtab.c	bpf: populate the per-cpu insertions/deletions counters for hashmaps	2023-07-06 12:42:25 -07:00
helpers.c	bpf: Use bpf_mem_free_rcu when bpf_obj_dropping refcounted nodes	2023-08-25 09:23:16 -07:00
inode.c	bpf: Support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands	2023-05-23 23:31:42 +02:00
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	cgroup changes for v6.4-rc1	2023-04-29 10:05:22 -07:00
log.c	bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log	2023-05-16 22:34:50 -07:00
lpm_trie.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
Makefile	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
map_in_map.c	bpf: Fix elem_size not being set for inner maps	2023-06-02 16:22:12 -07:00
map_in_map.h	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
map_iter.c	bpf: allow any program to use the bpf_map_sum_elem_count kfunc	2023-07-19 09:48:53 -07:00
memalloc.c	bpf: Non-atomically allocate freelist during prefill	2023-07-28 09:41:10 -07:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
mprog.c	bpf: Fix mprog detachment for empty mprog entry	2023-08-04 09:35:39 -07:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	net: invert the netdevice.h vs xdp.h dependency	2023-08-03 08:38:07 -07:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-11 12:05:14 -08:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
reuseport_array.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
ringbuf.c	bpf: Remove unnecessary ring buffer size check	2023-07-05 14:09:45 +02:00
stackmap.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
syscall.c	bpf: Remove a WARN_ON_ONCE warning related to local kptr	2023-08-24 08:15:16 -07:00
sysfs_btf.c	bpf: Load and verify kernel module BTFs	2020-11-10 15:25:53 -08:00
task_iter.c	bpf: keep a reference to the mm, in case the task is dead.	2022-12-28 14:11:48 -08:00
tcx.c	tcx: Fix splat during dev unregister	2023-07-31 14:44:02 -07:00
tnum.c	bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul	2021-06-01 13:34:15 +02:00
trampoline.c	bpf: Fix memleak due to fentry attach failure	2023-05-15 23:41:59 +02:00
verifier.c	bpf: Ensure kptr_struct_meta is non-NULL for collection insert and refcount_acquire	2023-08-25 09:23:16 -07:00