bpf: Disable migration when freeing stashed local kptr using obj drop

When a local kptr is stashed in a map and freed when the map goes away,
currently an error like the below appears:

[   39.195695] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u32:15/2875
[   39.196549] caller is bpf_mem_free+0x56/0xc0
[   39.196958] CPU: 15 PID: 2875 Comm: kworker/u32:15 Tainted: G           O       6.2.0-13016-g22df776a9a86 #4477
[   39.197897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[   39.198949] Workqueue: events_unbound bpf_map_free_deferred
[   39.199470] Call Trace:
[   39.199703]  <TASK>
[   39.199911]  dump_stack_lvl+0x60/0x70
[   39.200267]  check_preemption_disabled+0xbf/0xe0
[   39.200704]  bpf_mem_free+0x56/0xc0
[   39.201032]  ? bpf_obj_new_impl+0xa0/0xa0
[   39.201430]  bpf_obj_free_fields+0x1cd/0x200
[   39.201838]  array_map_free+0xad/0x220
[   39.202193]  ? finish_task_switch+0xe5/0x3c0
[   39.202614]  bpf_map_free_deferred+0xea/0x210
[   39.203006]  ? lockdep_hardirqs_on_prepare+0xe/0x220
[   39.203460]  process_one_work+0x64f/0xbe0
[   39.203822]  ? pwq_dec_nr_in_flight+0x110/0x110
[   39.204264]  ? do_raw_spin_lock+0x107/0x1c0
[   39.204662]  ? lockdep_hardirqs_on_prepare+0xe/0x220
[   39.205107]  worker_thread+0x74/0x7a0
[   39.205451]  ? process_one_work+0xbe0/0xbe0
[   39.205818]  kthread+0x171/0x1a0
[   39.206111]  ? kthread_complete_and_exit+0x20/0x20
[   39.206552]  ret_from_fork+0x1f/0x30
[   39.206886]  </TASK>

This happens because the call to __bpf_obj_drop_impl I added in the patch
adding support for stashing local kptrs doesn't disable migration. Prior
to that patch, __bpf_obj_drop_impl logic only ran when called by a BPF
progarm, whereas now it can be called from map free path, so it's
necessary to explicitly disable migration.

Also, refactor a bit to just call __bpf_obj_drop_impl directly instead
of bothering w/ dtor union and setting pointer-to-obj_drop.

Fixes: c8e187540914 ("bpf: Support __kptr to local kptrs")
Reported-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Link: https://lore.kernel.org/r/20230313214641.3731908-1-davemarchevsky@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 756b85f0d0d38c56624ff1543fadc76ac1ee3310..71cc92a4ba487eef3cce04de1501de4666b78795 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -190,18 +190,14 @@ enum btf_field_type {
 };
 
 typedef void (*btf_dtor_kfunc_t)(void *);
-typedef void (*btf_dtor_obj_drop)(void *, const struct btf_record *);
 
 struct btf_field_kptr {
        struct btf *btf;
        struct module *module;
-       union {
-               /* dtor used if btf_is_kernel(btf), otherwise the type
-                * is program-allocated and obj_drop is used
-                */
-               btf_dtor_kfunc_t dtor;
-               btf_dtor_obj_drop obj_drop;
-       };
+       /* dtor used if btf_is_kernel(btf), otherwise the type is
+        * program-allocated, dtor is NULL,  and __bpf_obj_drop_impl is used
+        */
+       btf_dtor_kfunc_t dtor;
        u32 btf_id;
 };
 

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 66fad7a16b6cf69bda212d3b58688f5004c08136..b7e5a5510b910252cbce2874063bbb2058876bc9 100644 (file)
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3551,8 +3551,6 @@ static int btf_find_field(const struct btf *btf, const struct btf_type *t,
        return -EINVAL;
 }
 
-extern void __bpf_obj_drop_impl(void *p, const struct btf_record *rec);
-
 static int btf_parse_kptr(const struct btf *btf, struct btf_field *field,
                          struct btf_field_info *info)
 {
@@ -3578,7 +3576,7 @@ static int btf_parse_kptr(const struct btf *btf, struct btf_field *field,
                /* Type exists only in program BTF. Assume that it's a MEM_ALLOC
                 * kptr allocated via bpf_obj_new
                 */
-               field->kptr.dtor = (void *)&__bpf_obj_drop_impl;
+               field->kptr.dtor = NULL;
                id = info->kptr.type_id;
                kptr_btf = (struct btf *)btf;
                btf_get(kptr_btf);

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0684febc447a8ad6d4dce706f84dab2bc520caf6..5b88301a2ae02dce8715f50430d8e4f103c5151b 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -650,6 +650,8 @@ void bpf_obj_free_timer(const struct btf_record *rec, void *obj)
        bpf_timer_cancel_and_free(obj + rec->timer_off);
 }
 
+extern void __bpf_obj_drop_impl(void *p, const struct btf_record *rec);
+
 void bpf_obj_free_fields(const struct btf_record *rec, void *obj)
 {
        const struct btf_field *fields;
@@ -679,9 +681,11 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj)
                                pointee_struct_meta = btf_find_struct_meta(field->kptr.btf,
                                                                           field->kptr.btf_id);
                                WARN_ON_ONCE(!pointee_struct_meta);
-                               field->kptr.obj_drop(xchgd_field, pointee_struct_meta ?
-                                                                 pointee_struct_meta->record :
-                                                                 NULL);
+                               migrate_disable();
+                               __bpf_obj_drop_impl(xchgd_field, pointee_struct_meta ?
+                                                                pointee_struct_meta->record :
+                                                                NULL);
+                               migrate_enable();
                        } else {
                                field->kptr.dtor(xchgd_field);
                        }