• Jiri Olsa's avatar
    bpf: Disable preemption in bpf_event_output · d62cc390
    Jiri Olsa authored
    We received report [1] of kernel crash, which is caused by
    using nesting protection without disabled preemption.
    
    The bpf_event_output can be called by programs executed by
    bpf_prog_run_array_cg function that disabled migration but
    keeps preemption enabled.
    
    This can cause task to be preempted by another one inside the
    nesting protection and lead eventually to two tasks using same
    perf_sample_data buffer and cause crashes like:
    
      BUG: kernel NULL pointer dereference, address: 0000000000000001
      #PF: supervisor instruction fetch in kernel mode
      #PF: error_code(0x0010) - not-present page
      ...
      ? perf_output_sample+0x12a/0x9a0
      ? finish_task_switch.isra.0+0x81/0x280
      ? perf_event_output+0x66/0xa0
      ? bpf_event_output+0x13a/0x190
      ? bpf_event_output_data+0x22/0x40
      ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb
      ? xa_load+0x87/0xe0
      ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0
      ? release_sock+0x3e/0x90
      ? sk_setsockopt+0x1a1/0x12f0
      ? udp_pre_connect+0x36/0x50
      ? inet_dgram_connect+0x93/0xa0
      ? __sys_connect+0xb4/0xe0
      ? udp_setsockopt+0x27/0x40
      ? __pfx_udp_push_pending_frames+0x10/0x10
      ? __sys_setsockopt+0xdf/0x1a0
      ? __x64_sys_connect+0xf/0x20
      ? do_syscall_64+0x3a/0x90
      ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
    
    Fixing this by disabling preemption in bpf_event_output.
    
    [1] https://github.com/cilium/cilium/issues/26756
    Cc: stable@vger.kernel.org
    Reported-by: default avatarOleg "livelace" Popov <o.popov@livelace.ru>
    Closes: https://github.com/cilium/cilium/issues/26756
    Fixes: 2a916f2f ("bpf: Use migrate_disable/enable in array macros and cgroup/lirc code.")
    Acked-by: default avatarHou Tao <houtao1@huawei.com>
    Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
    Link: https://lore.kernel.org/r/20230725084206.580930-3-jolsa@kernel.orgSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    d62cc390
bpf_trace.c 76.5 KB