Pu Lehui b11a9b4f28 bpf: cpumap: Fix memory leak in cpu_map_update_elem ... [ Upstream commit 4369016497319a9635702da010d02af1ebb1849d ] Syzkaller reported a memory leak as follows: BUG: memory leak unreferenced object 0xff110001198ef748 (size 192): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 32 bytes): 00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00 ....J........... 00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff ........(....... backtrace: [<ffffffffadd28087>] __cpu_map_entry_alloc+0xf7/0xb00 [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0 [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520 [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720 [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90 [<ffffffffb029cc80>] do_syscall_64+0x30/0x40 [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 BUG: memory leak unreferenced object 0xff110001198ef528 (size 192): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffffadd281f0>] __cpu_map_entry_alloc+0x260/0xb00 [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0 [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520 [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720 [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90 [<ffffffffb029cc80>] do_syscall_64+0x30/0x40 [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 BUG: memory leak unreferenced object 0xff1100010fd93d68 (size 8): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace: [<ffffffffade5db3e>] kvmalloc_node+0x11e/0x170 [<ffffffffadd28280>] __cpu_map_entry_alloc+0x2f0/0xb00 [<ffffffffadd28d8e>] cpu_map_update_elem+0x2fe/0x3d0 [<ffffffffadc6d0fd>] bpf_map_update_value.isra.0+0x2bd/0x520 [<ffffffffadc7349b>] map_update_elem+0x4cb/0x720 [<ffffffffadc7d983>] __se_sys_bpf+0x8c3/0xb90 [<ffffffffb029cc80>] do_syscall_64+0x30/0x40 [<ffffffffb0400099>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 In the cpu_map_update_elem flow, when kthread_stop is called before calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit of kthread has been set by kthread_stop, the threadfn of rcpu->kthread will never be executed, and rcpu->refcnt will never be 0, which will lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be released. Calling kthread_stop before executing kthread's threadfn will return -EINTR. We can complete the release of memory resources in this state. Fixes: 6710e11269 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jesper Dangaard Brouer <hawk@kernel.org> Acked-by: Hou Tao <houtao1@huawei.com> Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-07-23 13:49:26 +02:00
..
preload
arraymap.c
bloom_filter.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
bpf_inode_storage.c
bpf_iter.c
bpf_local_storage.c	bpf: Annotate data races in bpf_local_storage	2023-05-24 17:32:36 +01:00
bpf_lru_list.c
bpf_lru_list.h
bpf_lsm.c	bpf: Fix the kernel crash caused by bpf_setsockopt().	2023-02-09 11:28:02 +01:00
bpf_struct_ops.c
bpf_struct_ops_types.h
bpf_task_storage.c
btf.c	bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set()	2023-07-19 16:22:05 +02:00
cgroup.c	bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen	2023-07-19 16:21:05 +02:00
cgroup_iter.c	cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers	2023-06-21 16:00:51 +02:00
core.c	bpf: Adjust insufficient default bpf_jit_limit	2023-03-30 12:49:08 +02:00
cpumap.c	bpf: cpumap: Fix memory leak in cpu_map_update_elem	2023-07-23 13:49:26 +02:00
devmap.c
disasm.c
disasm.h
dispatcher.c	bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE()	2022-11-07 16:07:35 -08:00
hashtab.c	bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps	2023-05-30 14:03:21 +01:00
helpers.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
inode.c
Kconfig
link_iter.c
local_storage.c	cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers	2023-06-21 16:00:51 +02:00
lpm_trie.c
Makefile
map_in_map.c	bpf: Fix elem_size not being set for inner maps	2023-06-14 11:15:17 +02:00
map_in_map.h
map_iter.c
memalloc.c	bpf: Zeroing allocated object from slab in bpf memory allocator	2023-03-10 09:33:06 +01:00
mmap_unlock_work.h
net_namespace.c
offload.c	bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD	2023-01-24 07:24:37 +01:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-11 12:05:14 -08:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
reuseport_array.c
ringbuf.c
stackmap.c
syscall.c	bpf: Force kprobe multi expected_attach_type for kprobe_multi link	2023-06-28 11:12:33 +02:00
sysfs_btf.c
task_iter.c	bpf: keep a reference to the mm, in case the task is dead.	2023-01-24 07:24:31 +01:00
tnum.c
trampoline.c	bpf: Fix memleak due to fentry attach failure	2023-07-19 16:21:05 +02:00
verifier.c	bpf: Fix max stack depth check for async callbacks	2023-07-23 13:49:22 +02:00