Message ID | 20190513165916.259013-1-edumazet@google.com |
---|---|
State | Accepted |
Delegated to: | BPF Maintainers |
Headers | show |
Series | [net] bpf: devmap: fix use-after-free Read in__dev_map_entry_free | expand |
On 05/13/2019 06:59 PM, Eric Dumazet wrote: > synchronize_rcu() is fine when the rcu callbacks only need > to free memory (kfree_rcu() or direct kfree() call rcu call backs) > > __dev_map_entry_free() is a bit more complex, so we need to make > sure that call queued __dev_map_entry_free() callbacks have completed. > > sysbot report: > > BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365 > [inline] > BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300 > kernel/bpf/devmap.c:379 > Read of size 8 at addr ffff8801b8da38c8 by task ksoftirqd/1/18 > [...] > > Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") > Signed-off-by: Eric Dumazet <edumazet@google.com> > Reported-by: syzbot+457d3e2ffbcf31aee5c0@syzkaller.appspotmail.com > Acked-by: Toke Høiland-Jørgensen <toke@redhat.com> > Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Applied, thanks!
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 191b79948424f4b21b7aa120abc03801264bf0a6..1e525d70f83354e451b738ffb8e42d83b5fa932f 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -164,6 +164,9 @@ static void dev_map_free(struct bpf_map *map) bpf_clear_redirect_map(map); synchronize_rcu(); + /* Make sure prior __dev_map_entry_free() have completed. */ + rcu_barrier(); + /* To ensure all pending flush operations have completed wait for flush * bitmap to indicate all flush_needed bits to be zero on _all_ cpus. * Because the above synchronize_rcu() ensures the map is disconnected