Commit 079082c6 authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Jakub Kicinski
Browse files

tcx: Fix splat during dev unregister 



During unregister_netdevice_many_notify(), the ordering of our concerned
function calls is like this:

  unregister_netdevice_many_notify
    dev_shutdown
	qdisc_put
            clsact_destroy
    tcx_uninstall

The syzbot reproducer triggered a case that the qdisc refcnt is not
zero during dev_shutdown().

tcx_uninstall() will then WARN_ON_ONCE(tcx_entry(entry)->miniq_active)
because the miniq is still active and the entry should not be freed.
The latter assumed that qdisc destruction happens before tcx teardown.

This fix is to avoid tcx_uninstall() doing tcx_entry_free() when the
miniq is still alive and let the clsact_destroy() do the free later, so
that we do not assume any specific ordering for either of them.

If still active, tcx_uninstall() does clear the entry when flushing out
the prog/link. clsact_destroy() will then notice the "!tcx_entry_is_active()"
and then does the tcx_entry_free() eventually.

Fixes: e420bed0 ("bpf: Add fd-based tcx multi-prog infra with link support")
Reported-by: default avatar <syzbot+376a289e86a0fd02b9ba@syzkaller.appspotmail.com>
Reported-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Co-developed-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Tested-by: default avatar <syzbot+376a289e86a0fd02b9ba@syzkaller.appspotmail.com>
Tested-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/222255fe07cb58f15ee662e7ee78328af5b438e4.1690549248.git.daniel@iogearbox.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent df41fa67

include/linux/bpf_mprog.h

+16 −0
Original line number Diff line number Diff line
@@ -256,6 +256,22 @@ static inline void bpf_mprog_entry_copy(struct bpf_mprog_entry *dst, 
	memcpy(dst->fp_items, src->fp_items, sizeof(src->fp_items));

}



static inline void bpf_mprog_entry_clear(struct bpf_mprog_entry *dst)

{

	memset(dst->fp_items, 0, sizeof(dst->fp_items));

}



static inline void bpf_mprog_clear_all(struct bpf_mprog_entry *entry,

				       struct bpf_mprog_entry **entry_new)

{

	struct bpf_mprog_entry *peer;



	peer = bpf_mprog_peer(entry);

	bpf_mprog_entry_clear(peer);

	peer->parent->count = 0;

	*entry_new = peer;

}



static inline void bpf_mprog_entry_grow(struct bpf_mprog_entry *entry, int idx)

{

	int total = bpf_mprog_total(entry);

kernel/bpf/tcx.c

+8 −4
Original line number Diff line number Diff line
@@ -94,15 +94,19 @@ int tcx_prog_detach(const union bpf_attr *attr, struct bpf_prog *prog) 


void tcx_uninstall(struct net_device *dev, bool ingress)

{

	struct bpf_mprog_entry *entry, *entry_new = NULL;

	struct bpf_tuple tuple = {};

	struct bpf_mprog_entry *entry;

	struct bpf_mprog_fp *fp;

	struct bpf_mprog_cp *cp;

	bool active;



	entry = tcx_entry_fetch(dev, ingress);

	if (!entry)

		return;

	tcx_entry_update(dev, NULL, ingress);

	active = tcx_entry(entry)->miniq_active;

	if (active)

		bpf_mprog_clear_all(entry, &entry_new);

	tcx_entry_update(dev, entry_new, ingress);

	tcx_entry_sync();

	bpf_mprog_foreach_tuple(entry, fp, cp, tuple) {

		if (tuple.link)
@@ -111,7 +115,7 @@ void tcx_uninstall(struct net_device *dev, bool ingress) 
			bpf_prog_put(tuple.prog);

		tcx_skeys_dec(ingress);

	}

	WARN_ON_ONCE(tcx_entry(entry)->miniq_active);

	if (!active)

		tcx_entry_free(entry);

}