OSDN Git Service

bpf: Fix nested bpf_bprintf_prepare with more per-cpu buffers
authorFlorent Revest <revest@chromium.org>
Tue, 11 May 2021 08:10:54 +0000 (10:10 +0200)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 11 May 2021 21:02:33 +0000 (14:02 -0700)
commite2d5b2bb769fa5f500760caba76436ba3a10a895
tree00a9235741290b2d7a4405f38b1ea2bfa4b3e45b
parent35e3815fa8102fab4dee75f3547472c66581125d
bpf: Fix nested bpf_bprintf_prepare with more per-cpu buffers

The bpf_seq_printf, bpf_trace_printk and bpf_snprintf helpers share one
per-cpu buffer that they use to store temporary data (arguments to
bprintf). They "get" that buffer with try_get_fmt_tmp_buf and "put" it
by the end of their scope with bpf_bprintf_cleanup.

If one of these helpers gets called within the scope of one of these
helpers, for example: a first bpf program gets called, uses
bpf_trace_printk which calls raw_spin_lock_irqsave which is traced by
another bpf program that calls bpf_snprintf, then the second "get"
fails. Essentially, these helpers are not re-entrant. They would return
-EBUSY and print a warning message once.

This patch triples the number of bprintf buffers to allow three levels
of nesting. This is very similar to what was done for tracepoints in
"9594dc3c7e7 bpf: fix nested bpf tracepoints with per-cpu data"

Fixes: d9c9e4db186a ("bpf: Factorize bpf_trace_printk and bpf_seq_printf")
Reported-by: syzbot+63122d0bc347f18c1884@syzkaller.appspotmail.com
Signed-off-by: Florent Revest <revest@chromium.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210511081054.2125874-1-revest@chromium.org
kernel/bpf/helpers.c