[PATCH OLK-5.10 0/2] mainline patch submission for OLK-5.10
Jiri Olsa (1): bpf: Clear buf on error in __bpf_get_task_stack Kumar Kartikeya Dwivedi (1): bpf: Zero queue and stack outputs on lock failure kernel/bpf/queue_stack_maps.c | 8 ++++++-- kernel/bpf/stackmap.c | 7 +++++-- 2 files changed, 11 insertions(+), 4 deletions(-) -- 2.34.1
From: Jiri Olsa <jolsa@kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f5d242825ca417bb6afe35fde6e8880f97ca43fb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path. Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key. Fixes: 06ab134ce8ec ("bpf: Refcount task stack in bpf_get_task_stack") Fixes: b992f01e6615 ("bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260803210149.296496-10-jolsa@kernel.org Conflicts: kernel/bpf/stackmap.c [commit 58cfc2201d964163fe9c4a703136eb64db799f08 not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/stackmap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 558728cba6e0..0c3504e598e3 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -676,14 +676,17 @@ BPF_CALL_4(bpf_get_task_stack, struct task_struct *, task, void *, buf, struct pt_regs *regs; long res = -EINVAL; - if (!try_get_task_stack(task)) + if (!try_get_task_stack(task)) { + memset(buf, 0, size); return -EFAULT; + } regs = task_pt_regs(task); if (regs) res = __bpf_get_stack(regs, task, NULL, buf, size, flags); + else + memset(buf, 0, size); put_task_stack(task); - return res; } -- 2.34.1
From: Kumar Kartikeya Dwivedi <memxor@gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------------------- bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call. Fixes: a34a9f1a19af ("bpf: Avoid deadlock when using queue and stack maps from NMI") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260719125419.1782196-1-memxor@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Conflicts: kernel/bpf/queue_stack_maps.c [commit 2f41503d647629cfafea42cf6f827e4139536703 not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/queue_stack_maps.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c index a047a2053d41..4d4480dc8350 100644 --- a/kernel/bpf/queue_stack_maps.c +++ b/kernel/bpf/queue_stack_maps.c @@ -112,8 +112,10 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete) void *ptr; if (in_nmi()) { - if (!raw_spin_trylock_irqsave(&qs->lock, flags)) + if (!raw_spin_trylock_irqsave(&qs->lock, flags)) { + memset(value, 0, qs->map.value_size); return -EBUSY; + } } else { raw_spin_lock_irqsave(&qs->lock, flags); } @@ -147,8 +149,10 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete) u32 index; if (in_nmi()) { - if (!raw_spin_trylock_irqsave(&qs->lock, flags)) + if (!raw_spin_trylock_irqsave(&qs->lock, flags)) { + memset(value, 0, qs->map.value_size); return -EBUSY; + } } else { raw_spin_lock_irqsave(&qs->lock, flags); } -- 2.34.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/27034 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/4D5... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/27034 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/4D5...
participants (2)
-
Chen Yuxi -
patchwork bot