Files
linux/include/linux
Jiri Olsa 4b7de80160 bpf: Fix prog_array_map_poke_run map poke update
Lee pointed out issue found by syscaller [0] hitting BUG in prog array
map poke update in prog_array_map_poke_run function due to error value
returned from bpf_arch_text_poke function.

There's race window where bpf_arch_text_poke can fail due to missing
bpf program kallsym symbols, which is accounted for with check for
-EINVAL in that BUG_ON call.

The problem is that in such case we won't update the tail call jump
and cause imbalance for the next tail call update check which will
fail with -EBUSY in bpf_arch_text_poke.

I'm hitting following race during the program load:

  CPU 0                             CPU 1

  bpf_prog_load
    bpf_check
      do_misc_fixups
        prog_array_map_poke_track

                                    map_update_elem
                                      bpf_fd_array_map_update_elem
                                        prog_array_map_poke_run

                                          bpf_arch_text_poke returns -EINVAL

    bpf_prog_kallsyms_add

After bpf_arch_text_poke (CPU 1) fails to update the tail call jump, the next
poke update fails on expected jump instruction check in bpf_arch_text_poke
with -EBUSY and triggers the BUG_ON in prog_array_map_poke_run.

Similar race exists on the program unload.

Fixing this by moving the update to bpf_arch_poke_desc_update function which
makes sure we call __bpf_arch_text_poke that skips the bpf address check.

Each architecture has slightly different approach wrt looking up bpf address
in bpf_arch_text_poke, so instead of splitting the function or adding new
'checkip' argument in previous version, it seems best to move the whole
map_poke_run update as arch specific code.

  [0] https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810

Fixes: ebf7d1f508 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Reported-by: syzbot+97a4fe20470e9bc30810@syzkaller.appspotmail.com
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Cc: Lee Jones <lee@kernel.org>
Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/bpf/20231206083041.1306660-2-jolsa@kernel.org
2023-12-06 22:40:16 +01:00
..
2023-10-05 09:13:42 -07:00
2023-10-24 13:08:14 -07:00
2023-11-04 10:22:52 +01:00
2023-05-20 19:20:30 +02:00
2023-09-18 09:28:22 +01:00
2023-05-19 23:23:52 +05:30
2023-08-23 08:21:37 +01:00
2023-09-11 08:13:18 +00:00
2023-11-10 13:54:58 +00:00
2023-10-11 08:46:01 -07:00
2023-08-09 08:21:22 +02:00
2023-09-22 08:52:13 -06:00
2023-05-31 13:06:57 +02:00
2023-11-01 22:33:53 -07:00
2023-10-30 21:48:22 -04:00
2023-10-04 10:41:56 -07:00
2023-10-04 10:41:56 -07:00
2023-05-25 09:26:19 +02:00
2023-04-17 18:01:23 +02:00
2023-09-11 23:59:47 -04:00
2023-03-06 15:49:07 -06:00
2023-03-19 10:02:04 -07:00
2023-06-13 16:49:23 +02:00
2023-10-25 20:19:00 +02:00
2023-09-13 10:48:48 +02:00
2023-05-01 17:50:18 -07:00
2023-08-04 11:02:46 +01:00
2023-10-12 09:58:02 +02:00
2023-07-14 13:47:07 -06:00
2023-10-11 10:11:54 -07:00
2023-08-18 10:12:10 -07:00
2023-10-18 14:43:21 -07:00
2023-10-04 10:41:57 -07:00
2023-10-16 12:44:06 -04:00
2023-10-16 12:44:06 -04:00
2023-08-18 10:18:59 -07:00
2023-11-13 11:02:30 +00:00
2023-10-18 10:01:33 +02:00
2023-07-11 14:12:19 -07:00
2023-06-20 20:17:10 -07:00
2023-08-18 10:12:25 -07:00
2023-06-23 16:59:30 -07:00
2023-06-05 09:36:39 +02:00
2023-11-15 04:18:31 +01:00
2023-09-29 17:20:46 -07:00
2023-10-03 21:18:13 +02:00
2023-03-06 09:57:07 +01:00
2023-08-12 09:18:47 -07:00
2023-11-10 09:20:55 +01:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-09-11 22:10:47 +02:00
2023-05-23 12:55:12 -07:00
2023-07-15 11:34:49 -07:00
2023-06-23 16:59:28 -07:00
2023-05-18 19:52:31 -07:00
2023-06-11 18:22:47 +02:00
2023-06-05 09:36:39 +02:00
2023-10-15 13:19:42 +01:00
2023-11-01 10:02:18 +00:00
2023-10-18 14:43:21 -07:00
2023-08-21 13:37:26 -07:00
2023-11-03 09:16:42 +00:00
2023-10-18 14:43:21 -07:00
2023-08-07 17:55:54 +00:00
2023-08-11 21:12:47 +02:00
2023-03-16 13:08:39 -07:00
2023-09-14 16:16:36 +02:00
2023-10-27 18:04:28 +08:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-04-05 20:03:01 -07:00
2023-04-21 03:02:34 -04:00
2023-10-18 14:34:18 -07:00
2023-08-21 14:52:16 +02:00
2023-08-21 13:37:27 -07:00