[bpf,v2,0/5] bpf: Fix the release of inner map

Message

Hou Tao Nov. 13, 2023, 12:33 p.m. UTC

From: Hou Tao <[e-mail]>

Hi,

The patchset aims to fix the release of inner map in map array or map
htab. The release of inner map is different with normal map. For normal
map, the map is released after the bpf program which uses the map is
destroyed, because the bpf program tracks the used maps. However bpf
program can not track the used inner map because these inner map may be
updated or deleted dynamically, and for now the ref-count of inner map
is decreased after the inner map is remove from outer map, so the inner
map may be freed before the bpf program, which is accessing the inner
map, exits and there will be use-after-free problem as demonstrated by
patch #5.

The patchset fixes the problem by deferring the release of inner map.
The freeing of inner map is deferred according to the sleepable context
of the bpf programs which own the outer map. Patch #1 fixes the warning
when running the newly-added selftest under interpreter mode. Patch #2
adds more parameters to .map_fd_put_ptr(). Patch #3 fixes the potential
use-after-free problem by waiting for one RCU GP and one tasks trace RCU
GP unconditionally. Patch #4 optimizes the free of inner map by removing
the unnecessary RCU GP waiting and patch #5 add a selftest to
demonstrate the potential use-after-free problem.

Please see individual patches for more details. And comments are always
welcome.

Change Log:
v2:
  * defer the invocation of ops->map_free() instead of bpf_map_put() (Martin)
  * update selftest to make it being reproducible under JIT mode (Martin)
  * remove unnecessary preparatory patches

v1: https://lore.kernel.org/bpf/[e-mail]

Hou Tao (5):
  bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
  bpf: Add map and need_defer parameters to .map_fd_put_ptr()
  bpf: Defer the free of inner map when necessary
  bpf: Optimize the free of inner map
  selftests/bpf: Add test cases for inner map

 include/linux/bpf.h                           |  14 +-
 kernel/bpf/arraymap.c                         |  12 +-
 kernel/bpf/hashtab.c                          |   6 +-
 kernel/bpf/helpers.c                          |  13 +-
 kernel/bpf/map_in_map.c                       |  21 ++-
 kernel/bpf/map_in_map.h                       |   2 +-
 kernel/bpf/syscall.c                          |  16 ++
 kernel/bpf/verifier.c                         |   5 +
 .../selftests/bpf/prog_tests/map_in_map.c     | 141 ++++++++++++++++++
 .../selftests/bpf/progs/access_map_in_map.c   |  93 ++++++++++++
 10 files changed, 304 insertions(+), 19 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/map_in_map.c
 create mode 100644 tools/testing/selftests/bpf/progs/access_map_in_map.c