Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: Fix possible race in inc_misses_counter

It seems inc_misses_counter() suffers from same issue fixed in
the commit d979617aa84d ("bpf: Fixes possible race in update_prog_stats()
for 32bit arches"):
As it can run while interrupts are enabled, it could
be re-entered and the u64_stats syncp could be mangled.

Fixes: 9ed9e9ba2337 ("bpf: Count the number of times recursion was prevented")
Signed-off-by: He Fengqing <hefengqing@huawei.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20220122102936.1219518-1-hefengqing@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

authored by

He Fengqing and committed by
Alexei Starovoitov
0e3135d3 63ee956f

+3 -2
+3 -2
kernel/bpf/trampoline.c
··· 550 550 static void notrace inc_misses_counter(struct bpf_prog *prog) 551 551 { 552 552 struct bpf_prog_stats *stats; 553 + unsigned int flags; 553 554 554 555 stats = this_cpu_ptr(prog->stats); 555 - u64_stats_update_begin(&stats->syncp); 556 + flags = u64_stats_update_begin_irqsave(&stats->syncp); 556 557 u64_stats_inc(&stats->misses); 557 - u64_stats_update_end(&stats->syncp); 558 + u64_stats_update_end_irqrestore(&stats->syncp, flags); 558 559 } 559 560 560 561 /* The logic is similar to bpf_prog_run(), but with an explicit