[PATCH v2 bpf-next 0/2] fixes for bpf_prog_pack

[PATCH v2 bpf-next 0/2] fixes for bpf_prog_pack

[Song Liu]

Changes v1 => v2:
1. Rephrase comments in 2/2. (Yonghong)

Two fixes for bpf_prog_pack.

Song Liu (2):
  x86: disable HAVE_ARCH_HUGE_VMALLOC on 32-bit x86
  bpf, x86: set header->size properly before freeing it

 arch/x86/Kconfig            | 2 +-
 arch/x86/net/bpf_jit_comp.c | 5 ++++-
 kernel/bpf/core.c           | 9 ++++++---
 3 files changed, 11 insertions(+), 5 deletions(-)

--
2.30.2

[PATCH v2 bpf-next 1/2] x86: disable HAVE_ARCH_HUGE_VMALLOC on 32-bit x86

[Song Liu]

kernel test robot reported kernel BUG like:

[ 44.587744][ T1] kernel BUG at arch/x86/mm/physaddr.c:76!
[ 44.590151][ T1] __vmalloc_area_node (mm/vmalloc.c:622 mm/vmalloc.c:2995)
[ 44.590151][ T1] __vmalloc_node_range (mm/vmalloc.c:3108)
[ 44.590151][ T1] __vmalloc_node (mm/vmalloc.c:3157)

which is triggered with HAVE_ARCH_HUGE_VMALLOC on 32-bit x86. Since BPF
only uses HAVE_ARCH_HUGE_VMALLOC for x86_64, turn it off for 32-bit x86.

Reported-by: kernel test robot <oliver.sang@intel.com>
Fixes: fac54e2bfb5b ("x86/Kconfig: Select HAVE_ARCH_HUGE_VMALLOC with HAVE_ARCH_HUGE_VMAP")
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Song Liu <song@kernel.org>
---
 arch/x86/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 995f2dc28631..9b356da6f46b 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -158,7 +158,7 @@ config X86
 	select HAVE_ALIGNED_STRUCT_PAGE		if SLUB
 	select HAVE_ARCH_AUDITSYSCALL
 	select HAVE_ARCH_HUGE_VMAP		if X86_64 || X86_PAE
-	select HAVE_ARCH_HUGE_VMALLOC		if HAVE_ARCH_HUGE_VMAP
+	select HAVE_ARCH_HUGE_VMALLOC		if X86_64
 	select HAVE_ARCH_JUMP_LABEL
 	select HAVE_ARCH_JUMP_LABEL_RELATIVE
 	select HAVE_ARCH_KASAN			if X86_64
-- 
2.30.2

[PATCH v2 bpf-next 2/2] bpf, x86: set header->size properly before freeing it

[Song Liu]

On do_jit failure path, the header is freed by bpf_jit_binary_pack_free.
While bpf_jit_binary_pack_free doesn't require proper ro_header->size,
bpf_prog_pack_free still uses it. Set header->size in bpf_int_jit_compile
before calling bpf_jit_binary_pack_free.

Fixes: 1022a5498f6f ("bpf, x86_64: Use bpf_jit_binary_pack_alloc")
Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]")
Reported-by: Kui-Feng Lee <kuifeng@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Song Liu <song@kernel.org>
---
 arch/x86/net/bpf_jit_comp.c | 5 ++++-
 kernel/bpf/core.c           | 9 ++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index c7db0fe4de2f..e6ff8f4f9ea4 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -2330,8 +2330,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 		if (proglen <= 0) {
 out_image:
 			image = NULL;
-			if (header)
+			if (header) {
+				bpf_arch_text_copy(&header->size, &rw_header->size,
+						   sizeof(rw_header->size));
 				bpf_jit_binary_pack_free(header, rw_header);
+			}
 			prog = orig_prog;
 			goto out_addrs;
 		}
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index ebb0193d07f0..ab630f773ec1 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1112,13 +1112,16 @@ int bpf_jit_binary_pack_finalize(struct bpf_prog *prog,
  *   1) when the program is freed after;
  *   2) when the JIT engine fails (before bpf_jit_binary_pack_finalize).
  * For case 2), we need to free both the RO memory and the RW buffer.
- * Also, ro_header->size in 2) is not properly set yet, so rw_header->size
- * is used for uncharge.
+ *
+ * bpf_jit_binary_pack_free requires proper ro_header->size. However,
+ * bpf_jit_binary_pack_alloc does not set it. Therefore, ro_header->size
+ * must be set with either bpf_jit_binary_pack_finalize (normal path) or
+ * bpf_arch_text_copy (when jit fails).
  */
 void bpf_jit_binary_pack_free(struct bpf_binary_header *ro_header,
 			      struct bpf_binary_header *rw_header)
 {
-	u32 size = rw_header ? rw_header->size : ro_header->size;
+	u32 size = ro_header->size;
 
 	bpf_prog_pack_free(ro_header);
 	kvfree(rw_header);
-- 
2.30.2

Re: [PATCH v2 bpf-next 0/2] fixes for bpf_prog_pack

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 2 Mar 2022 09:51:24 -0800 you wrote:
> Changes v1 => v2:
> 1. Rephrase comments in 2/2. (Yonghong)
> 
> Two fixes for bpf_prog_pack.
> 
> Song Liu (2):
>   x86: disable HAVE_ARCH_HUGE_VMALLOC on 32-bit x86
>   bpf, x86: set header->size properly before freeing it
> 
> [...]

Here is the summary with links:
  - [v2,bpf-next,1/2] x86: disable HAVE_ARCH_HUGE_VMALLOC on 32-bit x86
    https://git.kernel.org/bpf/bpf-next/c/eed1fcee556f
  - [v2,bpf-next,2/2] bpf, x86: set header->size properly before freeing it
    https://git.kernel.org/bpf/bpf-next/c/676b2daabaf9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html