Martin KaFai Lau a89d14410e bpf: Address KCSAN report on bpf_lru_list ... [ Upstream commit ee9fd0ac3017c4313be91a220a9ac4c99dde7ad4 ] KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE() and WRITE_ONCE() pattern instead of data_race(). There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref(). This patch also adds bpf_lru_node_clear_ref() to do the WRITE_ONCE(node->ref, 0) also. ================================================================== BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1: __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline] __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline] __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline] __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0: bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline] __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x01 -> 0x00 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 ================================================================== Reported-by: syzbot+ebe648a84e8784763f82@syzkaller.appspotmail.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/r/20230511043748.1384166-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-08-11 11:45:25 +02:00
..
arraymap.c
bpf_lru_list.c	bpf: Address KCSAN report on bpf_lru_list	2023-08-11 11:45:25 +02:00
bpf_lru_list.h	bpf: Address KCSAN report on bpf_lru_list	2023-08-11 11:45:25 +02:00
btf.c	bpf: btf: fix truncated last_member_type_id in btf_struct_resolve	2022-10-26 13:19:25 +02:00
cgroup.c
core.c	bpf: Adjust insufficient default bpf_jit_limit	2023-04-05 11:15:34 +02:00
cpumap.c	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2020-05-02 17:25:53 +02:00
devmap.c	bpf: devmap: fix wrong interface selection in notifier_call	2019-12-01 09:17:01 +01:00
disasm.c	bpf: Introduce BPF nospec instruction for mitigating Spectre v4	2021-09-22 11:47:58 +02:00
disasm.h
hashtab.c	bpf: Remove recursion prevention from rcu free callback	2020-10-01 13:14:34 +02:00
helpers.c
inode.c	bpf: Fix a rcu warning for bpffs map pretty-print	2020-10-01 13:14:52 +02:00
local_storage.c
lpm_trie.c	bpf: lpm_trie: check left child of last leftmost node for NULL	2019-07-03 13:14:48 +02:00
Makefile	bpf: silence warning messages in core	2019-07-26 09:14:06 +02:00
map_in_map.c
map_in_map.h
offload.c	bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill	2020-02-28 16:38:59 +01:00
percpu_freelist.c
percpu_freelist.h
reuseport_array.c
sockmap.c
stackmap.c	bpf: Fix integer overflow in prealloc_elems_and_freelist()	2021-10-13 10:10:51 +02:00
syscall.c	bpf: Ensure correct locking around vulnerable function find_vpid()	2022-10-26 13:19:25 +02:00
tnum.c	bpf: Fix incorrect verifier simulation of ARSH under ALU32	2020-01-23 08:21:32 +01:00
verifier.c	bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields	2023-05-30 12:42:14 +01:00
xskmap.c