linux-stable.git/kernel, branch v6.6.26

bpf: support deferring bpf_link dealloc to after RCU grace period

2024-04-10T14:36:06+00:00

commit 1a80dbcb2dbaf6e4c216e62e30fa7d3daa8001ce upstream.

BPF link for some program types is passed as a "context" which can be
used by those BPF programs to look up additional information. E.g., for
multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values.

Because of this runtime dependency, when bpf_link refcnt drops to zero
there could still be active BPF programs running accessing link data.

This patch adds generic support to defer bpf_link dealloc callback to
after RCU GP, if requested. This is done by exposing two different
deallocation callbacks, one synchronous and one deferred. If deferred
one is provided, bpf_link_free() will schedule dealloc_deferred()
callback to happen after RCU GP.

BPF is using two flavors of RCU: "classic" non-sleepable one and RCU
tasks trace one. The latter is used when sleepable BPF programs are
used. bpf_link_free() accommodates that by checking underlying BPF
program's sleepable flag, and goes either through normal RCU GP only for
non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP
(taking into account rcu_trace_implies_rcu_gp() optimization), if BPF
program is sleepable.

We use this for multi-kprobe and multi-uprobe links, which dereference
link during program run. We also preventively switch raw_tp link to use
deferred dealloc callback, as upcoming changes in bpf-next tree expose
raw_tp link data (specifically, cookie value) to BPF program at runtime
as well.

Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
Reported-by: syzbot+981935d9485a560bfbcb@syzkaller.appspotmail.com
Reported-by: syzbot+2cb5a6c573e98db598cc@syzkaller.appspotmail.com
Reported-by: syzbot+62d8b26793e8a2bd0516@syzkaller.appspotmail.com
Signed-off-by: Andrii Nakryiko 
Acked-by: Jiri Olsa 
Link: https://lore.kernel.org/r/20240328052426.3042617-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov 
Signed-off-by: Greg Kroah-Hartman

bpf: put uprobe link's path and task in release callback

2024-04-10T14:36:06+00:00

commit e9c856cabefb71d47b2eeb197f72c9c88e9b45b0 upstream.

There is no need to delay putting either path or task to deallocation
step. It can be done right after bpf_uprobe_unregister. Between release
and dealloc, there could be still some running BPF programs, but they
don't access either task or path, only data in link->uprobes, so it is
safe to do.

On the other hand, doing path_put() in dealloc callback makes this
dealloc sleepable because path_put() itself might sleep. Which is
problematic due to the need to call uprobe's dealloc through call_rcu(),
which is what is done in the next bug fix patch. So solve the problem by
releasing these resources early.

Signed-off-by: Andrii Nakryiko 
Link: https://lore.kernel.org/r/20240328052426.3042617-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov 
Signed-off-by: Greg Kroah-Hartman

bpf: Protect against int overflow for stack access size

2024-04-10T14:35:43+00:00

[ Upstream commit ecc6a2101840177e57c925c102d2d29f260d37c8 ]

This patch re-introduces protection against the size of access to stack
memory being negative; the access size can appear negative as a result
of overflowing its signed int representation. This should not actually
happen, as there are other protections along the way, but we should
protect against it anyway. One code path was missing such protections
(fixed in the previous patch in the series), causing out-of-bounds array
accesses in check_stack_range_initialized(). This patch causes the
verification of a program with such a non-sensical access size to fail.

This check used to exist in a more indirect way, but was inadvertendly
removed in a833a17aeac7.

Fixes: a833a17aeac7 ("bpf: Fix verification of indirect var-off stack access")
Reported-by: syzbot+33f4297b5f927648741a@syzkaller.appspotmail.com
Reported-by: syzbot+aafd0513053a1cbf52ef@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/CAADnVQLORV5PT0iTAhRER+iLBTkByCYNBYyvBSgjN1T31K+gOw@mail.gmail.com/
Acked-by: Andrii Nakryiko 
Signed-off-by: Andrei Matei 
Link: https://lore.kernel.org/r/20240327024245.318299-3-andreimatei1@gmail.com
Signed-off-by: Alexei Starovoitov 
Signed-off-by: Sasha Levin

Revert "workqueue.c: Increase workqueue name length"

2024-04-04T18:23:07+00:00

This reverts commit 43a181f8f41aca27e7454cf44a6dfbccc8b14e92 which is
commit 31c89007285d365aa36f71d8fb0701581c770a27 upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: Move pwq->max_active to wq->max_active"

2024-04-04T18:23:07+00:00

This reverts commit 82e098f5bed1ff167332d26f8551662098747ec4 which is
commit a045a272d887575da17ad86d6573e82871b50c27 upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: Factor out pwq_is_empty()"

2024-04-04T18:23:07+00:00

This reverts commit bad184d26a4f68aa00ad75502f9669950a790f71 which is
commit afa87ce85379e2d93863fce595afdb5771a84004 upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: Replace pwq_activate_inactive_work() with [__]pwq_activate_work()"

2024-04-04T18:23:07+00:00

This reverts commit 6c592f0bb96815117538491e5ba12e0a8a8c4493 which is
commit 4c6380305d21e36581b451f7337a36c93b64e050 upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: Move nr_active handling into helpers"

2024-04-04T18:23:07+00:00

This reverts commit 4023a2d95076918abe2757d60810642a8115b586 which is
commit 1c270b79ce0b8290f146255ea9057243f6dd3c17 upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: Make wq_adjust_max_active() round-robin pwqs while activating"

2024-04-04T18:23:07+00:00

This reverts commit 5f99fee6f2dea1228980c3e785ab1a2c69b4da3c which is
commit qc5404d4e6df6faba1007544b5f4e62c7c14416dd upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman

Revert "workqueue: RCU protect wq->dfl_pwq and implement accessors for it"

2024-04-04T18:23:06+00:00

This reverts commit bd31fb926dfa02d2ccfb4b79389168b1d16f36b1 which is
commit 9f66cff212bb3c1cd25996aaa0dfd0c9e9d8baab upstream.

The workqueue patches backported to 6.6.y caused some reported
regressions, so revert them for now.

Reported-by: Thorsten Leemhuis 
Cc: Tejun Heo 
Cc: Marek Szyprowski 
Cc: Nathan Chancellor 
Cc: Sasha Levin 
Cc: Audra Mitchell 
Link: https://lore.kernel.org/all/ce4c2f67-c298-48a0-87a3-f933d646c73b@leemhuis.info/
Signed-off-by: Greg Kroah-Hartman