Received-SPF: pass (google.com: domain of linux-kernel+bounces-28510-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Subject: Re: [PATCH AUTOSEL 4.19 07/22] bpf: Add map and need_defer parameters
 to .map_fd_put_ptr()
To: Sasha Levin <sashal@kernel.org>, linux-kernel@vger.kernel.org,
 stable@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>, daniel@iogearbox.net,
 andrii@kernel.org, bpf@vger.kernel.org
References: <20240116200432.260016-1-sashal@kernel.org>
 <20240116200432.260016-7-sashal@kernel.org>
From: Hou Tao <houtao@huaweicloud.com>
Message-ID: <aa7ce9ae-cba1-120c-a5d3-851c4e4d1fb2@huaweicloud.com>
Date: Wed, 17 Jan 2024 12:16:00 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.6.0
Precedence: bulk
MIME-Version: 1.0
In-Reply-To: <20240116200432.260016-7-sashal@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Language: en-US


On 1/17/2024 4:04 AM, Sasha Levin wrote:
> From: Hou Tao <houtao1@huawei.com>
>
> [ Upstream commit 20c20bd11a0702ce4dc9300c3da58acf551d9725 ]
>
> map is the pointer of outer map, and need_defer needs some explanation.
> need_defer tells the implementation to defer the reference release of
> the passed element and ensure that the element is still alive before
> the bpf program, which may manipulate it, exits.
>
> The following three cases will invoke map_fd_put_ptr() and different
> need_defer values will be passed to these callers:
>
> 1) release the reference of the old element in the map during map update
>    or map deletion. The release must be deferred, otherwise the bpf
>    program may incur use-after-free problem, so need_defer needs to be
>    true.
> 2) release the reference of the to-be-added element in the error path of
>    map update. The to-be-added element is not visible to any bpf
>    program, so it is OK to pass false for need_defer parameter.
> 3) release the references of all elements in the map during map release.
>    Any bpf program which has access to the map must have been exited and
>    released, so need_defer=false will be OK.
>
> These two parameters will be used by the following patches to fix the
> potential use-after-free problem for map-in-map.
>
> Signed-off-by: Hou Tao <houtao1@huawei.com>
> Link: https://lore.kernel.org/r/20231204140425.1480317-3-houtao@huaweicloud.com
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>

The patch is just a preparatory patch for fix, please drop it.