bpf: add missing rcu protection when releasing programs from prog_array

Normally the program attachment place (like sockets, qdiscs) takes
care of rcu protection and calls bpf_prog_put() after a grace period.
The programs stored inside prog_array may not be attached anywhere,
so prog_array needs to take care of preserving rcu protection.
Otherwise bpf_tail_call() will race with bpf_prog_put().
To solve that introduce bpf_prog_put_rcu() helper function and use
it in 3 places where unattached program can decrement refcnt:
closing program fd, deleting/replacing program in prog_array.

Fixes: 04fd61ab36ec ("bpf: allow bpf programs to tail-call other bpf programs")
Reported-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 20 insertions, 3 deletions

diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 614bcd4c1d74..cb31229a6fa4 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -202,7 +202,7 @@ static int prog_array_map_update_elem(struct bpf_map *map, void *key,
 
         old_prog = xchg(array->prog + index, prog);
         if (old_prog)
-                bpf_prog_put(old_prog);
+                bpf_prog_put_rcu(old_prog);
 
         return 0;
 }
@@ -218,7 +218,7 @@ static int prog_array_map_delete_elem(struct bpf_map *map, void *key)
 
         old_prog = xchg(array->prog + index, NULL);
         if (old_prog) {
-                bpf_prog_put(old_prog);
+                bpf_prog_put_rcu(old_prog);
                 return 0;
         } else {
                 return -ENOENT;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 98a69bd83069..a1b14d197a4f 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -432,6 +432,23 @@ static void free_used_maps(struct bpf_prog_aux *aux)
         kfree(aux->used_maps);
 }
 
+static void __prog_put_rcu(struct rcu_head *rcu)
+{
+        struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
+
+        free_used_maps(aux);
+        bpf_prog_free(aux->prog);
+}
+
+/* version of bpf_prog_put() that is called after a grace period */
+void bpf_prog_put_rcu(struct bpf_prog *prog)
+{
+        if (atomic_dec_and_test(&prog->aux->refcnt)) {
+                prog->aux->prog = prog;
+                call_rcu(&prog->aux->rcu, __prog_put_rcu);
+        }
+}
+
 void bpf_prog_put(struct bpf_prog *prog)
 {
         if (atomic_dec_and_test(&prog->aux->refcnt)) {
@@ -445,7 +462,7 @@ static int bpf_prog_release(struct inode *inode, struct file *filp)
 {
         struct bpf_prog *prog = filp->private_data;
 
-        bpf_prog_put(prog);
+        bpf_prog_put_rcu(prog);
         return 0;
 }