From: Pu Lehui Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436 Freed by task 14: ... __free_rcu kernel/bpf/memalloc.c:281 [inline] __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291 rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571 rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621 rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651 Initially, we suspected that alloc_bulk() lacked RCU Tasks Trace protection when accessing waiting_for_gp_ttrace. However, explicitly adding rcu_read_lock_trace() did not help. This is expected because, as noted in commit 57b23c0f612d ("bpf: Retire rcu_trace_implies_rcu_gp()"), an RCU Tasks Trace GP currently implies (and will continue to imply in the future) a normal RCU GP. Since alloc_bulk() runs in an RCU read-side CS (!PREEMPT_RT runs in IRQ context, PREEMPT_RT runs with guard(rcu)), an RCU Tasks Trace GP cannot complete while alloc_bulk() is accessing the list. Thus, the callback __free_rcu cannot run concurrently, ruling out missing RCU read-side locks as the cause. And same for free_by_rcu_ttrace list. Further investigation revealed that the UAF does not occur before the RCU Tasks Trace grace period expires, but rather during the execution of its callback. When the callback invokes llist_del_all to reclaim waiting_for_gp_ttrace nodes, there is no synchronization protecting against concurrent alloc_bulk() calls. If alloc_bulk() operates on waiting_for_gp_ttrace simultaneously, a race condition ensues, as illustrated below: CPU0 CPU1 __free_rcu (RCU Tasks Trace callback) alloc_bulk (RCU read-side CS) llist_del_first(&c->waiting_for_gp_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; free_all(llist_del_all(&c->waiting_for_gp_ttrace)) llist_for_each_safe(pos, t, llnode) free_one(pos); next = READ_ONCE(entry->next); <-- trigger UAF } while (!try_cmpxchg(&head->first, &entry, next)); Since alloc_bulk() operates on waiting_for_gp_ttrace under RCU read-side CS, Fix this by introducing a raw spinlock to synchronize the concurrent consumption (llist_del_first vs llist_del_all) on waiting_for_gp_ttrace. Note that free_by_rcu_ttrace does not suffer from this issue as it only has a single active consumer during normal operation. Fixes: 04fabf00b4d3 ("bpf: Allow reuse from waiting_for_gp_ttrace list.") Suggested-by: Alexei Starovoitov Suggested-by: Hou Tao Signed-off-by: Pu Lehui --- kernel/bpf/memalloc.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c index e9662db7198f..58296e92a4fe 100644 --- a/kernel/bpf/memalloc.c +++ b/kernel/bpf/memalloc.c @@ -119,6 +119,7 @@ struct bpf_mem_cache { struct llist_head waiting_for_gp_ttrace; struct rcu_head rcu_ttrace; atomic_t call_rcu_ttrace_in_progress; + raw_spinlock_t lock; }; struct bpf_mem_caches { @@ -207,6 +208,7 @@ static void add_obj_to_free_list(struct bpf_mem_cache *c, void *obj) static void alloc_bulk(struct bpf_mem_cache *c, int cnt, int node, bool atomic) { struct mem_cgroup *memcg = NULL, *old_memcg; + unsigned long flags; gfp_t gfp; void *obj; int i; @@ -228,12 +230,14 @@ static void alloc_bulk(struct bpf_mem_cache *c, int cnt, int node, bool atomic) if (i >= cnt) return; + raw_spin_lock_irqsave(&c->lock, flags); for (; i < cnt; i++) { - obj = llist_del_first(&c->waiting_for_gp_ttrace); + obj = __llist_del_first(&c->waiting_for_gp_ttrace); if (!obj) break; add_obj_to_free_list(c, obj); } + raw_spin_unlock_irqrestore(&c->lock, flags); if (i >= cnt) return; @@ -279,8 +283,14 @@ static int free_all(struct bpf_mem_cache *c, struct llist_node *llnode, bool per static void __free_rcu(struct rcu_head *head) { struct bpf_mem_cache *c = container_of(head, struct bpf_mem_cache, rcu_ttrace); + struct llist_node *llnode; + unsigned long flags; - free_all(c, llist_del_all(&c->waiting_for_gp_ttrace), !!c->percpu_size); + raw_spin_lock_irqsave(&c->lock, flags); + llnode = __llist_del_all(&c->waiting_for_gp_ttrace); + raw_spin_unlock_irqrestore(&c->lock, flags); + + free_all(c, llnode, !!c->percpu_size); atomic_set(&c->call_rcu_ttrace_in_progress, 0); } @@ -297,6 +307,7 @@ static void enque_to_free(struct bpf_mem_cache *c, void *obj) static void do_call_rcu_ttrace(struct bpf_mem_cache *c) { struct llist_node *llnode, *t; + unsigned long flags; if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1)) { if (unlikely(READ_ONCE(c->draining))) { @@ -307,8 +318,10 @@ static void do_call_rcu_ttrace(struct bpf_mem_cache *c) } WARN_ON_ONCE(!llist_empty(&c->waiting_for_gp_ttrace)); + raw_spin_lock_irqsave(&c->lock, flags); llist_for_each_safe(llnode, t, llist_del_all(&c->free_by_rcu_ttrace)) - llist_add(llnode, &c->waiting_for_gp_ttrace); + __llist_add(llnode, &c->waiting_for_gp_ttrace); + raw_spin_unlock_irqrestore(&c->lock, flags); if (unlikely(READ_ONCE(c->draining))) { __free_rcu(&c->rcu_ttrace); @@ -535,6 +548,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->objcg = objcg; c->percpu_size = percpu_size; c->tgt = c; + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } @@ -557,7 +571,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->objcg = objcg; c->percpu_size = percpu_size; c->tgt = c; - + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } @@ -609,7 +623,7 @@ int bpf_mem_alloc_percpu_unit_init(struct bpf_mem_alloc *ma, int size) c->objcg = objcg; c->percpu_size = percpu_size; c->tgt = c; - + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } @@ -620,6 +634,8 @@ int bpf_mem_alloc_percpu_unit_init(struct bpf_mem_alloc *ma, int size) static void drain_mem_cache(struct bpf_mem_cache *c) { bool percpu = !!c->percpu_size; + struct llist_node *llnode; + unsigned long flags; /* No progs are using this bpf_mem_cache, but htab_map_free() called * bpf_mem_cache_free() for all remaining elements and they can be in @@ -629,7 +645,10 @@ static void drain_mem_cache(struct bpf_mem_cache *c) * on these lists, so it is safe to use __llist_del_all(). */ free_all(c, llist_del_all(&c->free_by_rcu_ttrace), percpu); - free_all(c, llist_del_all(&c->waiting_for_gp_ttrace), percpu); + raw_spin_lock_irqsave(&c->lock, flags); + llnode = __llist_del_all(&c->waiting_for_gp_ttrace); + raw_spin_unlock_irqrestore(&c->lock, flags); + free_all(c, llnode, percpu); free_all(c, __llist_del_all(&c->free_llist), percpu); free_all(c, __llist_del_all(&c->free_llist_extra), percpu); free_all(c, __llist_del_all(&c->free_by_rcu), percpu); -- 2.34.1