Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc

The commit c83597fa5dc6 ("bpf: Refactor some inode/task/sk storage functions
for reuse"), refactored the bpf_{sk,task,inode}_storage_free() into
bpf_local_storage_unlink_nolock() which then later renamed to
bpf_local_storage_destroy(). The commit accidentally passed the
"bool uncharge_mem = false" argument to bpf_selem_unlink_storage_nolock()
which then stopped the uncharge from happening to the sk->sk_omem_alloc.

This missing uncharge only happens when the sk is going away (during
__sk_destruct).

This patch fixes it by always passing "uncharge_mem = true". It is a
noop to the task/inode/cgroup storage because they do not have the
map_local_storage_(un)charge enabled in the map_ops. A followup patch
will be done in bpf-next to remove the uncharge_mem argument.

A selftest is added in the next patch.

Fixes: c83597fa5dc6 ("bpf: Refactor some inode/task/sk storage functions for reuse")
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20230901231129.578493-3-martin.lau@linux.dev

authored by

Martin KaFai Lau and committed by
Daniel Borkmann
55d49f75 a96a44ab

+1 -1
+1 -1
kernel/bpf/bpf_local_storage.c
··· 760 760 * of the loop will set the free_cgroup_storage to true. 761 761 */ 762 762 free_storage = bpf_selem_unlink_storage_nolock( 763 - local_storage, selem, false, true); 763 + local_storage, selem, true, true); 764 764 } 765 765 raw_spin_unlock_irqrestore(&local_storage->lock, flags); 766 766