iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/kernel/bpf
History
Pu Lehui 4369016497 bpf: cpumap: Fix memory leak in cpu_map_update_elem 
Syzkaller reported a memory leak as follows:

BUG: memory leak
unreferenced object 0xff110001198ef748 (size 192):
  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
  hex dump (first 32 bytes):
    00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00  ....J...........
    00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff  ........(.......
  backtrace:
    [<ffffffffadd28087>] __cpu_map_entry_alloc+0xf7/0xb00
    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

BUG: memory leak
unreferenced object 0xff110001198ef528 (size 192):
  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffffadd281f0>] __cpu_map_entry_alloc+0x260/0xb00
    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

BUG: memory leak
unreferenced object 0xff1100010fd93d68 (size 8):
  comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s)
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace:
    [<ffffffffade5db3e>] kvmalloc_node+0x11e/0x170
    [<ffffffffadd28280>] __cpu_map_entry_alloc+0x2f0/0xb00
    [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0
    [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520
    [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720
    [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90
    [<ffffffffb029cc80>] do_syscall_64+0x30/0x40
    [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

In the cpu_map_update_elem flow, when kthread_stop is called before
calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit
of kthread has been set by kthread_stop, the threadfn of rcpu->kthread
will never be executed, and rcpu->refcnt will never be 0, which will
lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be
released.

Calling kthread_stop before executing kthread's threadfn will return
-EINTR. We can complete the release of memory resources in this state.

Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Acked-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-07-11 19:57:03 -07:00
..
preload
bpf: Replace all non-returning strlcpy with strscpy
2023-05-31 13:04:20 +02:00
arraymap.c
bpf: return long from bpf_map_ops funcs
2023-03-22 15:11:30 -07:00
bloom_filter.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
bpf_cgrp_storage.c
bpf: Teach verifier that certain helpers accept NULL pointer.
2023-04-04 16:57:16 -07:00
bpf_inode_storage.c
Networking changes for 6.4.
2023-04-26 16:07:23 -07:00
bpf_iter.c
bpf: implement numbers iterator
2023-03-08 16:19:51 -08:00
bpf_local_storage.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
bpf_lru_list.c
bpf: Address KCSAN report on bpf_lru_list
2023-05-12 12:01:03 -07:00
bpf_lru_list.h
bpf: Address KCSAN report on bpf_lru_list
2023-05-12 12:01:03 -07:00
bpf_lsm.c
bpf: Fix the kernel crash caused by bpf_setsockopt().
2023-01-26 23:26:40 -08:00
bpf_struct_ops_types.h
bpf: Add dummy BPF STRUCT_OPS for test purpose
2021-11-01 14:10:00 -07:00
bpf_struct_ops.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
bpf_task_storage.c
bpf: Teach verifier that certain helpers accept NULL pointer.
2023-04-04 16:57:16 -07:00
btf.c
bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set()
2023-07-03 18:48:09 +02:00
cgroup_iter.c
cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers
2023-03-17 12:07:13 -10:00
cgroup.c
bpf-next-for-netdev
2023-05-16 19:50:05 -07:00
core.c
bpf: Hide unused bpf_patch_call_args
2023-06-12 19:00:08 +02:00
cpumap.c
bpf: cpumap: Fix memory leak in cpu_map_update_elem
2023-07-11 19:57:03 -07:00
cpumask.c
bpf: Replace bpf_cpumask_any* with bpf_cpumask_any_distribute*
2023-06-12 15:09:11 -07:00
devmap.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
disasm.c
bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause
2021-09-02 14:49:23 +02:00
disasm.h
bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause
2021-09-02 14:49:23 +02:00
dispatcher.c
bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func
2022-12-14 12:02:14 -08:00
hashtab.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
helpers.c
bpf: Make bpf_refcount_acquire fallible for non-owning refs
2023-06-05 13:17:20 -07:00
inode.c
bpf: Support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands
2023-05-23 23:31:42 +02:00
Kconfig
rcu: Make the TASKS_RCU Kconfig option be selected
2022-04-20 16:52:58 -07:00
link_iter.c
bpf: Add bpf_link iterator
2022-05-10 11:20:45 -07:00
local_storage.c
cgroup changes for v6.4-rc1
2023-04-29 10:05:22 -07:00
log.c
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
2023-05-16 22:34:50 -07:00
lpm_trie.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
Makefile
bpf: Split off basic BPF verifier log into separate file
2023-04-11 18:05:42 +02:00
map_in_map.c
bpf: Fix elem_size not being set for inner maps
2023-06-02 16:22:12 -07:00
map_in_map.h
…
map_iter.c
bpf: Introduce MEM_RDONLY flag
2021-12-18 13:27:41 -08:00
memalloc.c
bpf: Factor out a common helper free_all()
2023-06-06 13:40:07 -07:00
mmap_unlock_work.h
bpf: Introduce helper bpf_find_vma
2021-11-07 11:54:51 -08:00
net_namespace.c
net: Add includes masked by netdevice.h including uapi/bpf.h
2021-12-29 20:03:05 -08:00
offload.c
bpf: netdev: init the offload table earlier
2023-05-15 07:07:41 -07:00
percpu_freelist.c
bpf: Initialize same number of free nodes for each pcpu_freelist
2022-11-11 12:05:14 -08:00
percpu_freelist.h
…
prog_iter.c
…
queue_stack_maps.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
reuseport_array.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
ringbuf.c
bpf: return long from bpf_map_ops funcs
2023-03-22 15:11:30 -07:00
stackmap.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
syscall.c
bpf-next-for-netdev
2023-06-24 14:52:28 -07:00
sysfs_btf.c
…
task_iter.c
bpf: keep a reference to the mm, in case the task is dead.
2022-12-28 14:11:48 -08:00
tnum.c
bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul
2021-06-01 13:34:15 +02:00
trampoline.c
bpf: Fix memleak due to fentry attach failure
2023-05-15 23:41:59 +02:00
verifier.c
bpf: Fix max stack depth check for async callbacks
2023-07-05 19:14:54 -07:00