bpf: Add map and need_defer parameters to .map_fd_put_ptr()

[ Upstream commit 20c20bd11a0702ce4dc9300c3da58acf551d9725 ]

map is the pointer of outer map, and need_defer needs some explanation.
need_defer tells the implementation to defer the reference release of
the passed element and ensure that the element is still alive before
the bpf program, which may manipulate it, exits.

The following three cases will invoke map_fd_put_ptr() and different
need_defer values will be passed to these callers:

1) release the reference of the old element in the map during map update
   or map deletion. The release must be deferred, otherwise the bpf
   program may incur use-after-free problem, so need_defer needs to be
   true.
2) release the reference of the to-be-added element in the error path of
   map update. The to-be-added element is not visible to any bpf
   program, so it is OK to pass false for need_defer parameter.
3) release the references of all elements in the map during map release.
   Any bpf program which has access to the map must have been exited and
   released, so need_defer=false will be OK.

These two parameters will be used by the following patches to fix the
potential use-after-free problem for map-in-map.

Signed-off-by: Hou Tao <houtao1@huawei.com>
Link: https://lore.kernel.org/r/20231204140425.1480317-3-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8f4379e93ad49b920891ffa6159c11c4c1cb1696..bfdf40be5360a84c197edea965667e61e8bdd51f 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -82,7 +82,11 @@ struct bpf_map_ops {
        /* funcs called by prog_array and perf_event_array map */
        void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
                                int fd);
-       void (*map_fd_put_ptr)(void *ptr);
+       /* If need_defer is true, the implementation should guarantee that
+        * the to-be-put element is still alive before the bpf program, which
+        * may manipulate it, exists.
+        */
+       void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
        int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
        u32 (*map_fd_sys_lookup_elem)(void *ptr);
        void (*map_seq_show_elem)(struct bpf_map *map, void *key,

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index f241bda2679d43d765c08eec6a6287bd6a8e4fa5..5102338129d5f6e5a777aed4bf9cce313816a1df 100644 (file)
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -764,7 +764,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
        }
 
        if (old_ptr)
-               map->ops->map_fd_put_ptr(old_ptr);
+               map->ops->map_fd_put_ptr(map, old_ptr, true);
        return 0;
 }
 
@@ -787,7 +787,7 @@ static int fd_array_map_delete_elem(struct bpf_map *map, void *key)
        }
 
        if (old_ptr) {
-               map->ops->map_fd_put_ptr(old_ptr);
+               map->ops->map_fd_put_ptr(map, old_ptr, true);
                return 0;
        } else {
                return -ENOENT;
@@ -811,8 +811,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
        return prog;
 }
 
-static void prog_fd_array_put_ptr(void *ptr)
+static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
+       /* bpf_prog is freed after one RCU or tasks trace grace period */
        bpf_prog_put(ptr);
 }
 
@@ -1139,8 +1140,9 @@ err_out:
        return ee;
 }
 
-static void perf_event_fd_array_put_ptr(void *ptr)
+static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
+       /* bpf_perf_event is freed after one RCU grace period */
        bpf_event_entry_free_rcu(ptr);
 }
 
@@ -1195,7 +1197,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map,
        return cgroup_get_from_fd(fd);
 }
 
-static void cgroup_fd_array_put_ptr(void *ptr)
+static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
        /* cgroup_put free cgrp after a rcu grace period */
        cgroup_put(ptr);

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index 0ce445aadfdfb19e3b7032dead3e73a36339c169..ec849731427251a119d5267d2f2efd3e2e5cfd93 100644 (file)
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -786,7 +786,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
 
        if (map->ops->map_fd_put_ptr) {
                ptr = fd_htab_map_get_ptr(map, l);
-               map->ops->map_fd_put_ptr(ptr);
+               map->ops->map_fd_put_ptr(map, ptr, true);
        }
 }
 
@@ -2023,7 +2023,7 @@ static void fd_htab_map_free(struct bpf_map *map)
                hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
                        void *ptr = fd_htab_map_get_ptr(map, l);
 
-                       map->ops->map_fd_put_ptr(ptr);
+                       map->ops->map_fd_put_ptr(map, ptr, false);
                }
        }
 
@@ -2064,7 +2064,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
 
        ret = htab_map_update_elem(map, key, &ptr, map_flags);
        if (ret)
-               map->ops->map_fd_put_ptr(ptr);
+               map->ops->map_fd_put_ptr(map, ptr, false);
 
        return ret;
 }

diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
index 39ab0b68cade574acb7a8226566e30aa91307ee1..0cf4cb685810557f78e29394dbbea5eae35319c9 100644 (file)
--- a/kernel/bpf/map_in_map.c
+++ b/kernel/bpf/map_in_map.c
@@ -100,7 +100,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
        return inner_map;
 }
 
-void bpf_map_fd_put_ptr(void *ptr)
+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
 {
        /* ptr->ops->map_free() has to go through one
         * rcu grace period by itself.

diff --git a/kernel/bpf/map_in_map.h b/kernel/bpf/map_in_map.h
index bcb7534afb3c0d073222a20bc7d38538e986ee27..7d61602354de8074126944aeea4bb1d116b939e1 100644 (file)
--- a/kernel/bpf/map_in_map.h
+++ b/kernel/bpf/map_in_map.h
@@ -13,7 +13,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd);
 void bpf_map_meta_free(struct bpf_map *map_meta);
 void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file,
                         int ufd);
-void bpf_map_fd_put_ptr(void *ptr);
+void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer);
 u32 bpf_map_fd_sys_lookup_elem(void *ptr);
 
 #endif