Commit ec9dd352 authored by Yonghong Song's avatar Yonghong Song Committed by David S. Miller

bpf: one perf event close won't free bpf program attached by another perf event

This patch fixes a bug exhibited by the following scenario:
  1. fd1 = perf_event_open with attr.config = ID1
  2. attach bpf program prog1 to fd1
  3. fd2 = perf_event_open with attr.config = ID1
     <this will be successful>
  4. user program closes fd2 and prog1 is detached from the tracepoint.
  5. user program with fd1 does not work properly as tracepoint
     no output any more.

The issue happens at step 4. Multiple perf_event_open can be called
successfully, but only one bpf prog pointer in the tp_event. In the
current logic, any fd release for the same tp_event will free
the tp_event->prog.

The fix is to free tp_event->prog only when the closing fd
corresponds to the one which registered the program.
Signed-off-by: default avatarYonghong Song <yhs@fb.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 008ba2a1
...@@ -272,6 +272,7 @@ struct trace_event_call { ...@@ -272,6 +272,7 @@ struct trace_event_call {
int perf_refcount; int perf_refcount;
struct hlist_head __percpu *perf_events; struct hlist_head __percpu *perf_events;
struct bpf_prog *prog; struct bpf_prog *prog;
struct perf_event *bpf_prog_owner;
int (*perf_perm)(struct trace_event_call *, int (*perf_perm)(struct trace_event_call *,
struct perf_event *); struct perf_event *);
......
...@@ -8171,6 +8171,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd) ...@@ -8171,6 +8171,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd)
} }
} }
event->tp_event->prog = prog; event->tp_event->prog = prog;
event->tp_event->bpf_prog_owner = event;
return 0; return 0;
} }
...@@ -8185,7 +8186,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) ...@@ -8185,7 +8186,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
return; return;
prog = event->tp_event->prog; prog = event->tp_event->prog;
if (prog) { if (prog && event->tp_event->bpf_prog_owner == event) {
event->tp_event->prog = NULL; event->tp_event->prog = NULL;
bpf_prog_put(prog); bpf_prog_put(prog);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment