bpf: add missing rcu protection when releasing programs from prog_array
authorAlexei Starovoitov <ast@plumgrid.com>
Fri, 29 May 2015 02:26:02 +0000 (19:26 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sun, 31 May 2015 07:27:51 +0000 (00:27 -0700)
commitabf2e7d6e2e315b32ee00067a69aaad2cf4e1b3f
tree073ee9134421f2ab9edcd226a48de1a4bea72554
parentd1f5f2bb91094c9e6f7c98610d637ffdaedef116
bpf: add missing rcu protection when releasing programs from prog_array

Normally the program attachment place (like sockets, qdiscs) takes
care of rcu protection and calls bpf_prog_put() after a grace period.
The programs stored inside prog_array may not be attached anywhere,
so prog_array needs to take care of preserving rcu protection.
Otherwise bpf_tail_call() will race with bpf_prog_put().
To solve that introduce bpf_prog_put_rcu() helper function and use
it in 3 places where unattached program can decrement refcnt:
closing program fd, deleting/replacing program in prog_array.

Fixes: 04fd61ab36ec ("bpf: allow bpf programs to tail-call other bpf programs")
Reported-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/bpf.h
kernel/bpf/arraymap.c
kernel/bpf/syscall.c