lkml.org 
[lkml]   [2022]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] bpf: cgroup: remove WARN_ON at bpf_cgroup_link_release
From
Date
On 2/27/22 2:40 PM, Dongliang Mu wrote:
> From: Dongliang Mu <mudongliangabcd@gmail.com>
>
> When syzkaller injects fault into memory allocation at
> bpf_prog_array_alloc, the kernel encounters a memory failure and
> returns non-zero, thus leading to one WARN_ON at
> bpf_cgroup_link_release. The stack trace is as follows:
>
> __kmalloc+0x7e/0x3d0
> bpf_prog_array_alloc+0x4f/0x60
> compute_effective_progs+0x132/0x580
> ? __sanitizer_cov_trace_pc+0x1a/0x40
> update_effective_progs+0x5e/0x260
> __cgroup_bpf_detach+0x293/0x760
> bpf_cgroup_link_release+0xad/0x400
> bpf_link_free+0xca/0x190
> bpf_link_put+0x161/0x1b0
> bpf_link_release+0x33/0x40
> __fput+0x286/0x9f0
>
> Fix this by removing the WARN_ON for __cgroup_bpf_detach.
>
> Reported-by: syzkaller <syzkaller@googlegroups.com>
> Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
> ---
> kernel/bpf/cgroup.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 514b4681a90a..fdbdcee6c9fa 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -896,8 +896,8 @@ static void bpf_cgroup_link_release(struct bpf_link *link)
> return;
> }
>
> - WARN_ON(__cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link,
> - cg_link->type));
> + __cgroup_bpf_detach(cg_link->cgroup, NULL, cg_link,
> + cg_link->type);

"Fixing" by removing WARN_ON is just papering over the issue which in this case as
mentioned is allocation failure on detach/teardown when allocating and recomputing
effective prog arrays..

> cg = cg_link->cgroup;
> cg_link->cgroup = NULL;
>

\
 
 \ /
  Last update: 2022-03-01 17:28    [W:0.270 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site