[bpf-next,0/2] bpf: fix NULL pointer dereference in

Message

Yonghong Song March 19, 2021, 12:17 a.m. UTC

Jiri Olsa reported a bug in
  https://lore.kernel.org/bpf/CAKH8qBuXCfUz=[e-mail]/T
where cgroup local storage pointer may be NULL in bpf_get_local_storage()
helper. There are two issues uncovered by this bug:
    (1). kprobe or tracepoint prog incorrectly sets cgroup local storage
         before prog run,
    (2). due to change from preempt_disable to migrate_disable,
         preemption is possible and percpu storage might be overwritten
         by other tasks.
Issue (1) has been fixed and this patch set fixed issue (2).
Please see details of Patch #1 for detailed fix.
Patch #2 fixed bpf_prog_test_run to use new signature for
bpf_cgroup_storage_set().

Patch #1 can be backported to bpf tree and Patch #2 cannot due to
refactoring done in bpf-next only.
I did not put a Fix tag as I am not able to find a proper one.
The original commit which changed from preempt_disable to
migrate_disable in bpf.h is just a wrapper where migrate_disable
still calls preempt_disable. The real migrate_disable change happens
later in kernel/sched/*.

Yonghong Song (2):
  bpf: fix NULL pointer dereference in bpf_get_local_storage() helper
  bpf: fix bpf_cgroup_storage_set() usage in test_run

 include/linux/bpf-cgroup.h | 53 +++++++++++++++++++++++++++++++++-----
 include/linux/bpf.h        | 22 +++++++++++++---
 kernel/bpf/helpers.c       | 15 ++++++++---
 kernel/bpf/local_storage.c |  3 ++-
 net/bpf/test_run.c         |  6 ++++-
 5 files changed, 83 insertions(+), 16 deletions(-)