summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorDave Marchevsky <davemarchevsky@fb.com>2023-04-21 00:44:31 -0700
committerDaniel Borkmann <daniel@iogearbox.net>2023-04-21 16:31:37 +0200
commit4ab07209d5cc8cb6d2a5324c07b3efc3b2fde494 (patch)
treef1dcb589695870ac2db152716ae539f73e10e475 /kernel
parentacf1c3d68e9a31f10d92bc67ad4673cdae5e8d92 (diff)
bpf: Fix bpf_refcount_acquire's refcount_t address calculation
When calculating the address of the refcount_t struct within a local kptr, bpf_refcount_acquire_impl should add refcount_off bytes to the address of the local kptr. Due to some missing parens, the function is incorrectly adding sizeof(refcount_t) * refcount_off bytes. This patch fixes the calculation. Due to the incorrect calculation, bpf_refcount_acquire_impl was trying to refcount_inc some memory well past the end of local kptrs, resulting in kasan and refcount complaints, as reported in [0]. In that thread, Florian and Eduard discovered that bpf selftests written in the new style - with __success and an expected __retval, specifically - were not actually being run. As a result, selftests added in bpf_refcount series weren't really exercising this behavior, and thus didn't unearth the bug. With this fixed behavior it's safe to revert commit 7c4b96c00043 ("selftests/bpf: disable program test run for progs/refcounted_kptr.c"), this patch does so. [0] https://lore.kernel.org/bpf/ZEEp+j22imoN6rn9@strlen.de/ Fixes: 7c50b1cb76ac ("bpf: Add bpf_refcount_acquire kfunc") Reported-by: Florian Westphal <fw@strlen.de> Reported-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Tested-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20230421074431.3548349-1-davemarchevsky@fb.com
Diffstat (limited to 'kernel')
-rw-r--r--kernel/bpf/helpers.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 00e5fb0682ac..8d368fa353f9 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -1925,7 +1925,7 @@ __bpf_kfunc void *bpf_refcount_acquire_impl(void *p__refcounted_kptr, void *meta
/* Could just cast directly to refcount_t *, but need some code using
* bpf_refcount type so that it is emitted in vmlinux BTF
*/
- ref = (struct bpf_refcount *)p__refcounted_kptr + meta->record->refcount_off;
+ ref = (struct bpf_refcount *)(p__refcounted_kptr + meta->record->refcount_off);
refcount_inc((refcount_t *)ref);
return (void *)p__refcounted_kptr;