]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bpf: fix corruption on concurrent perf_event_output calls
authorDaniel Borkmann <daniel@iogearbox.net>
Fri, 22 Dec 2017 15:23:00 +0000 (16:23 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 25 Dec 2017 13:26:31 +0000 (14:26 +0100)
commita23244e8845f510ce3ba8b77b32cdd3d3d8ae853
tree5a1460b940446c951f924dcf3515e2a9203d776a
parent2b3ea8ceb2bb71e9e58527661261dba127137d9b
bpf: fix corruption on concurrent perf_event_output calls

[ Upstream commit 283ca526a9bd75aed7350220d7b1f8027d99c3fd ]

When tracing and networking programs are both attached in the
system and both use event-output helpers that eventually call
into perf_event_output(), then we could end up in a situation
where the tracing attached program runs in user context while
a cls_bpf program is triggered on that same CPU out of softirq
context.

Since both rely on the same per-cpu perf_sample_data, we could
potentially corrupt it. This can only ever happen in a combination
of the two types; all tracing programs use a bpf_prog_active
counter to bail out in case a program is already running on
that CPU out of a different context. XDP and cls_bpf programs
by themselves don't have this issue as they run in the same
context only. Therefore, split both perf_sample_data so they
cannot be accessed from each other.

Fixes: 20b9d7ac4852 ("bpf: avoid excessive stack usage for perf_sample_data")
Reported-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Song Liu <songliubraving@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/trace/bpf_trace.c