Re: [PATCH bpf-next] bpf: Address KCSAN report on bpf_lru_list

[Yonghong Song <yhs@meta.com>]

On 5/10/23 9:37 PM, Martin KaFai Lau wrote:
> From: Martin KaFai Lau <martin.lau@kernel.org>
> 
> KCSAN reported a data-race when accessing node->ref.
> Although node->ref does not have to be accurate,
> take this chance to use a more common READ_ONCE() and WRITE_ONCE()
> pattern instead of data_race().
> 
> There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref().
> This patch also adds bpf_lru_node_clear_ref() to do the
> WRITE_ONCE(node->ref, 0) also.
> 
> ==================================================================
> BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
> 
> write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
> __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline]
> __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline]
> __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240
> bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline]
> bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline]
> bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499
> prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline]
> __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316
> bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
> bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
> generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
> bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
> __sys_bpf+0x338/0x810
> __do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
> __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
> bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline]
> __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332
> bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313
> bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200
> generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687
> bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534
> __sys_bpf+0x338/0x810
> __do_sys_bpf kernel/bpf/syscall.c:5096 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5094 [inline]
> __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> value changed: 0x01 -> 0x00
> 
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
> ==================================================================
> 
> Reported-by: syzbot+ebe648a84e8784763f82@syzkaller.appspotmail.com
> Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

Acked-by: Yonghong Song <yhs@fb.com>