From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AC39C742BA for ; Fri, 12 Jul 2019 12:27:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E9AB321019 for ; Fri, 12 Jul 2019 12:27:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562934474; bh=UgvX4NKm8hwhyfUD3407gBRNpyry022uPnp8FgjLEEA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=u/8sxtUfr2r4INaVuXLI1WymnWxucYjuHqhHNgqWHJZNi2Lj2N7HjWWIt6t6YHCbr msqkFsTTAt9qHIU9+4D3hBndsJ6622YSW/N+lrdKid1Y9m6EHWidET5q2cGbF4XQ3U UaDBCKvsvjjAOCFgiALnWPkgCUWKmVrxiMXNgGZs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728708AbfGLM1w (ORCPT ); Fri, 12 Jul 2019 08:27:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:40970 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728677AbfGLM1u (ORCPT ); Fri, 12 Jul 2019 08:27:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C7481216C8; Fri, 12 Jul 2019 12:27:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562934469; bh=UgvX4NKm8hwhyfUD3407gBRNpyry022uPnp8FgjLEEA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DV/8PEq6LvSpw8T66e6ZeXAcvuzzmd9TMbEDBezuZXkormBhIT1s8V2Gctq+hzGfp B+pEh2ZDSEcgoZsfsUnN2vD6ul1suy+0tC2k3lnQydtuQrs58NcqE3pBZXatGYrOZA GAdL0obzjGMB1KISzt0/cqGdGoXWcQZKGI+X2TsM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Toshiaki Makita , Daniel Borkmann , Sasha Levin Subject: [PATCH 5.1 064/138] bpf, devmap: Fix premature entry free on destroying map Date: Fri, 12 Jul 2019 14:18:48 +0200 Message-Id: <20190712121631.132305427@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190712121628.731888964@linuxfoundation.org> References: <20190712121628.731888964@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit d4dd153d551634683fccf8881f606fa9f3dfa1ef ] dev_map_free() waits for flush_needed bitmap to be empty in order to ensure all flush operations have completed before freeing its entries. However the corresponding clear_bit() was called before using the entries, so the entries could be used after free. All access to the entries needs to be done before clearing the bit. It seems commit a5e2da6e9787 ("bpf: netdev is never null in __dev_map_flush") accidentally changed the clear_bit() and memory access order. Note that the problem happens only in __dev_map_flush(), not in dev_map_flush_old(). dev_map_flush_old() is called only after nulling out the corresponding netdev_map entry, so dev_map_free() never frees the entry thus no such race happens there. Fixes: a5e2da6e9787 ("bpf: netdev is never null in __dev_map_flush") Signed-off-by: Toshiaki Makita Signed-off-by: Daniel Borkmann Signed-off-by: Sasha Levin --- kernel/bpf/devmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 1e525d70f833..e001fb1a96b1 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -291,10 +291,10 @@ void __dev_map_flush(struct bpf_map *map) if (unlikely(!dev)) continue; - __clear_bit(bit, bitmap); - bq = this_cpu_ptr(dev->bulkq); bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true); + + __clear_bit(bit, bitmap); } } -- 2.20.1