releases/4.6.4/bpf-perf-delay-release-of-bpf-prog-after-grace-period.patch

   1 From foo@baz Wed Jul  6 16:50:56 PDT 2016
   2 From: Daniel Borkmann <daniel@iogearbox.net>
   3 Date: Mon, 27 Jun 2016 21:38:11 +0200
   4 Subject: bpf, perf: delay release of BPF prog after grace period
   5
   6 From: Daniel Borkmann <daniel@iogearbox.net>
   7
   8 [ Upstream commit ceb56070359b7329b5678b5d95a376fcb24767be ]
   9
  10 Commit dead9f29ddcc ("perf: Fix race in BPF program unregister") moved
  11 destruction of BPF program from free_event_rcu() callback to __free_event(),
  12 which is problematic if used with tail calls: if prog A is attached as
  13 trace event directly, but at the same time present in a tail call map used
  14 by another trace event program elsewhere, then we need to delay destruction
  15 via RCU grace period since it can still be in use by the program doing the
  16 tail call (the prog first needs to be dropped from the tail call map, then
  17 trace event with prog A attached destroyed, so we get immediate destruction).
  18
  19 Fixes: dead9f29ddcc ("perf: Fix race in BPF program unregister")
  20 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
  21 Acked-by: Alexei Starovoitov <ast@kernel.org>
  22 Cc: Jann Horn <jann@thejh.net>
  23 Signed-off-by: David S. Miller <davem@davemloft.net>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25 ---
  26  include/linux/bpf.h  |    4 ++++
  27  kernel/events/core.c |    2 +-
  28  2 files changed, 5 insertions(+), 1 deletion(-)
  29
  30 --- a/include/linux/bpf.h
  31 +++ b/include/linux/bpf.h
  32 @@ -229,6 +229,10 @@ static inline struct bpf_prog *bpf_prog_
  33  static inline void bpf_prog_put(struct bpf_prog *prog)
  34  {
  35  }
  36 +
  37 +static inline void bpf_prog_put_rcu(struct bpf_prog *prog)
  38 +{
  39 +}
  40  #endif /* CONFIG_BPF_SYSCALL */
  41
  42  /* verifier prototypes for helper functions called from eBPF programs */
  43 --- a/kernel/events/core.c
  44 +++ b/kernel/events/core.c
  45 @@ -7143,7 +7143,7 @@ static void perf_event_free_bpf_prog(str
  46         prog = event->tp_event->prog;
  47         if (prog) {
  48                 event->tp_event->prog = NULL;
  49 -               bpf_prog_put(prog);
  50 +               bpf_prog_put_rcu(prog);
  51         }
  52  }
  53