[PATCH bpf-next] bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free

[PATCH bpf-next] bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free

[Hou Tao]

From: Hou Tao <houtao1@huawei.com>

There are two possible mismatched alloc and free cases in bpf memory
allocator:
1) allocate from cache X but free by cache Y with a different unit_size
2) allocate from per-cpu cache but free by kmalloc cache or vice versa

So add more WARN_ON_ONCE checks in free_bulk() and __free_by_rcu() to
spot these mismatched alloc and free early.

Signed-off-by: Hou Tao <houtao1@huawei.com>
---
 kernel/bpf/memalloc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
index 5308e386380af..63b909d277d47 100644
--- a/kernel/bpf/memalloc.c
+++ b/kernel/bpf/memalloc.c
@@ -340,6 +340,7 @@ static void free_bulk(struct bpf_mem_cache *c)
 	int cnt;
 
 	WARN_ON_ONCE(tgt->unit_size != c->unit_size);
+	WARN_ON_ONCE(tgt->percpu_size != c->percpu_size);
 
 	do {
 		inc_active(c, &flags);
@@ -365,6 +366,9 @@ static void __free_by_rcu(struct rcu_head *head)
 	struct bpf_mem_cache *tgt = c->tgt;
 	struct llist_node *llnode;
 
+	WARN_ON_ONCE(tgt->unit_size != c->unit_size);
+	WARN_ON_ONCE(tgt->percpu_size != c->percpu_size);
+
 	llnode = llist_del_all(&c->waiting_for_gp);
 	if (!llnode)
 		goto out;
-- 
2.29.2

Re: [PATCH bpf-next] bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:

On Sat, 21 Oct 2023 09:49:59 +0800 you wrote:
> From: Hou Tao <houtao1@huawei.com>
> 
> There are two possible mismatched alloc and free cases in bpf memory
> allocator:
> 1) allocate from cache X but free by cache Y with a different unit_size
> 2) allocate from per-cpu cache but free by kmalloc cache or vice versa
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free
    https://git.kernel.org/bpf/bpf-next/c/c421c12586b3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html