bpf: Fix truncated dmabuf iterator reads

If there is a large number (hundreds) of dmabufs allocated, the text
output generated from dmabuf_iter_seq_show can exceed common user buffer
sizes (e.g. PAGE_SIZE) necessitating multiple start/stop cycles to
iterate through all dmabufs. However the dmabuf iterator currently
returns NULL in dmabuf_iter_seq_start for all non-zero pos values, which
results in the truncation of the output before all dmabufs are handled.

After dma_buf_iter_begin / dma_buf_iter_next, the refcount of the buffer
is elevated so that the BPF iterator program can run without holding any
locks. When a stop occurs, instead of immediately dropping the reference
on the buffer, stash a pointer to the buffer in seq->priv until
either start is called or the iterator is released. This also enables
the resumption of iteration without first walking through the list of
dmabufs based on the pos value.

Fixes: 76ea95534995 ("bpf: Add dmabuf iterator")
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Link: https://lore.kernel.org/r/20251204000348.1413593-1-tjmercier@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/dmabuf_iter.c b/kernel/bpf/dmabuf_iter.c
index 4dd7ef7c145ca7c93de06d9d06f29487f0582544..cd500248abd959ce5214ce2dfb1694eaec0145a3 100644 (file)
--- a/kernel/bpf/dmabuf_iter.c
+++ b/kernel/bpf/dmabuf_iter.c
@@ -6,10 +6,33 @@
 #include <linux/kernel.h>
 #include <linux/seq_file.h>
 
+struct dmabuf_iter_priv {
+       /*
+        * If this pointer is non-NULL, the buffer's refcount is elevated to
+        * prevent destruction between stop/start. If reading is not resumed and
+        * start is never called again, then dmabuf_iter_seq_fini drops the
+        * reference when the iterator is released.
+        */
+       struct dma_buf *dmabuf;
+};
+
 static void *dmabuf_iter_seq_start(struct seq_file *seq, loff_t *pos)
 {
-       if (*pos)
-               return NULL;
+       struct dmabuf_iter_priv *p = seq->private;
+
+       if (*pos) {
+               struct dma_buf *dmabuf = p->dmabuf;
+
+               if (!dmabuf)
+                       return NULL;
+
+               /*
+                * Always resume from where we stopped, regardless of the value
+                * of pos.
+                */
+               p->dmabuf = NULL;
+               return dmabuf;
+       }
 
        return dma_buf_iter_begin();
 }
@@ -54,8 +77,11 @@ static void dmabuf_iter_seq_stop(struct seq_file *seq, void *v)
 {
        struct dma_buf *dmabuf = v;
 
-       if (dmabuf)
-               dma_buf_put(dmabuf);
+       if (dmabuf) {
+               struct dmabuf_iter_priv *p = seq->private;
+
+               p->dmabuf = dmabuf;
+       }
 }
 
 static const struct seq_operations dmabuf_iter_seq_ops = {
@@ -71,11 +97,27 @@ static void bpf_iter_dmabuf_show_fdinfo(const struct bpf_iter_aux_info *aux,
        seq_puts(seq, "dmabuf iter\n");
 }
 
+static int dmabuf_iter_seq_init(void *priv, struct bpf_iter_aux_info *aux)
+{
+       struct dmabuf_iter_priv *p = (struct dmabuf_iter_priv *)priv;
+
+       p->dmabuf = NULL;
+       return 0;
+}
+
+static void dmabuf_iter_seq_fini(void *priv)
+{
+       struct dmabuf_iter_priv *p = (struct dmabuf_iter_priv *)priv;
+
+       if (p->dmabuf)
+               dma_buf_put(p->dmabuf);
+}
+
 static const struct bpf_iter_seq_info dmabuf_iter_seq_info = {
        .seq_ops                = &dmabuf_iter_seq_ops,
-       .init_seq_private       = NULL,
-       .fini_seq_private       = NULL,
-       .seq_priv_size          = 0,
+       .init_seq_private       = dmabuf_iter_seq_init,
+       .fini_seq_private       = dmabuf_iter_seq_fini,
+       .seq_priv_size          = sizeof(struct dmabuf_iter_priv),
 };
 
 static struct bpf_iter_reg bpf_dmabuf_reg_info = {