Skip to content

Commit

Permalink
bpf: Add more WARN_ON_ONCE checks for mismatched alloc and free
Browse files Browse the repository at this point in the history
There are two possible mismatched alloc and free cases in BPF memory
allocator:

1) allocate from cache X but free by cache Y with a different unit_size
2) allocate from per-cpu cache but free by kmalloc cache or vice versa

So add more WARN_ON_ONCE checks in free_bulk() and __free_by_rcu() to
spot these mismatched alloc and free early.

Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20231021014959.3563841-1-houtao@huaweicloud.com
  • Loading branch information
Hou Tao authored and Daniel Borkmann committed Oct 26, 2023
1 parent 22360fa commit c421c12
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions kernel/bpf/memalloc.c
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,7 @@ static void free_bulk(struct bpf_mem_cache *c)
int cnt;

WARN_ON_ONCE(tgt->unit_size != c->unit_size);
WARN_ON_ONCE(tgt->percpu_size != c->percpu_size);

do {
inc_active(c, &flags);
Expand All @@ -365,6 +366,9 @@ static void __free_by_rcu(struct rcu_head *head)
struct bpf_mem_cache *tgt = c->tgt;
struct llist_node *llnode;

WARN_ON_ONCE(tgt->unit_size != c->unit_size);
WARN_ON_ONCE(tgt->percpu_size != c->percpu_size);

llnode = llist_del_all(&c->waiting_for_gp);
if (!llnode)
goto out;
Expand Down

0 comments on commit c421c12

Please sign in to comment.