7 files changed, 66 insertions, 16 deletions

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 2ce57645f3cd..0367a75f873b 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1099,7 +1099,6 @@ static inline void bpf_get_prog_name(const struct bpf_prog *prog, char *sym)
 
 #endif /* CONFIG_BPF_JIT */
 
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp);
 void bpf_prog_kallsyms_del_all(struct bpf_prog *fp);
 
 #define BPF_ANC         BIT(15)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 66088a9e9b9e..ef0e1e3e66f4 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -502,7 +502,7 @@ int bpf_remove_insns(struct bpf_prog *prog, u32 off, u32 cnt)
         return WARN_ON_ONCE(bpf_adj_branches(prog, off, off + cnt, off, false));
 }
 
-void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
+static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
 {
         int i;
 
diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index d27f3b60ff6d..3867864cdc2f 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -128,7 +128,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
 
                 if (!dtab->n_buckets) /* Overflow check */
                         return -EINVAL;
-                cost += sizeof(struct hlist_head) * dtab->n_buckets;
+                cost += (u64) sizeof(struct hlist_head) * dtab->n_buckets;
         }
 
         /* if map size is larger than memlock limit, reject it */
@@ -719,6 +719,32 @@ const struct bpf_map_ops dev_map_hash_ops = {
         .map_check_btf = map_check_no_btf,
 };
 
+static void dev_map_hash_remove_netdev(struct bpf_dtab *dtab,
+                                       struct net_device *netdev)
+{
+        unsigned long flags;
+        u32 i;
+
+        spin_lock_irqsave(&dtab->index_lock, flags);
+        for (i = 0; i < dtab->n_buckets; i++) {
+                struct bpf_dtab_netdev *dev;
+                struct hlist_head *head;
+                struct hlist_node *next;
+
+                head = dev_map_index_hash(dtab, i);
+
+                hlist_for_each_entry_safe(dev, next, head, index_hlist) {
+                        if (netdev != dev->dev)
+                                continue;
+
+                        dtab->items--;
+                        hlist_del_rcu(&dev->index_hlist);
+                        call_rcu(&dev->rcu, __dev_map_entry_free);
+                }
+        }
+        spin_unlock_irqrestore(&dtab->index_lock, flags);
+}
+
 static int dev_map_notification(struct notifier_block *notifier,
                                 ulong event, void *ptr)
 {
@@ -735,6 +761,11 @@ static int dev_map_notification(struct notifier_block *notifier,
                  */
                 rcu_read_lock();
                 list_for_each_entry_rcu(dtab, &dev_map_list, list) {
+                        if (dtab->map.map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+                                dev_map_hash_remove_netdev(dtab, netdev);
+                                continue;
+                        }
+
                         for (i = 0; i < dtab->map.max_entries; i++) {
                                 struct bpf_dtab_netdev *dev, *odev;
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 82eabd4e38ad..0937719b87e2 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1326,24 +1326,32 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu)
 {
         struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
 
+        kvfree(aux->func_info);
         free_used_maps(aux);
         bpf_prog_uncharge_memlock(aux->prog);
         security_bpf_prog_free(aux);
         bpf_prog_free(aux->prog);
 }
 
+static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
+{
+        bpf_prog_kallsyms_del_all(prog);
+        btf_put(prog->aux->btf);
+        bpf_prog_free_linfo(prog);
+
+        if (deferred)
+                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
+        else
+                __bpf_prog_put_rcu(&prog->aux->rcu);
+}
+
 static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
 {
         if (atomic_dec_and_test(&prog->aux->refcnt)) {
                 perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
                 /* bpf_prog_free_id() must be called first */
                 bpf_prog_free_id(prog, do_idr_lock);
-                bpf_prog_kallsyms_del_all(prog);
-                btf_put(prog->aux->btf);
-                kvfree(prog->aux->func_info);
-                bpf_prog_free_linfo(prog);
-
-                call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
+                __bpf_prog_put_noref(prog, true);
         }
 }
 
@@ -1741,11 +1749,12 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
         return err;
 
 free_used_maps:
-        bpf_prog_free_linfo(prog);
-        kvfree(prog->aux->func_info);
-        btf_put(prog->aux->btf);
-        bpf_prog_kallsyms_del_subprogs(prog);
-        free_used_maps(prog->aux);
+        /* In case we have subprogs, we need to wait for a grace
+         * period before we can tear down JIT memory since symbols
+         * are already exposed under kallsyms.
+         */
+        __bpf_prog_put_noref(prog, prog->aux->func_cnt);
+        return err;
 free_prog:
         bpf_prog_uncharge_memlock(prog);
 free_prog_sec:
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f93785e5833c..74cfb8b5ab33 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -88,11 +88,16 @@ static int bpf_lwt_input_reroute(struct sk_buff *skb)
         int err = -EINVAL;
 
         if (skb->protocol == htons(ETH_P_IP)) {
+                struct net_device *dev = skb_dst(skb)->dev;
                 struct iphdr *iph = ip_hdr(skb);
 
+                dev_hold(dev);
+                skb_dst_drop(skb);
                 err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                           iph->tos, skb_dst(skb)->dev);
+                                           iph->tos, dev);
+                dev_put(dev);
         } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                skb_dst_drop(skb);
                 err = ipv6_stub->ipv6_route_input(skb);
         } else {
                 err = -EAFNOSUPPORT;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 16d5f353163a..3049af269fbf 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_add_rcu(&xs->list, &umem->xsk_list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_del_rcu(&xs->list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
diff --git a/tools/testing/selftests/bpf/test_tc_edt.sh b/tools/testing/selftests/bpf/test_tc_edt.sh
index f38567ef694b..daa7d1b8d309 100755
--- a/tools/testing/selftests/bpf/test_tc_edt.sh
+++ b/tools/testing/selftests/bpf/test_tc_edt.sh
@@ -59,7 +59,7 @@ ip netns exec ${NS_SRC} tc filter add dev veth_src egress \
 
 # start the listener
 ip netns exec ${NS_DST} bash -c \
-        "nc -4 -l -s ${IP_DST} -p 9000 >/dev/null &"
+        "nc -4 -l -p 9000 >/dev/null &"
 declare -i NC_PID=$!
 sleep 1