• Daniel Borkmann's avatar
    bpf: fix kallsyms handling for subprogs · 4f74d809
    Daniel Borkmann authored
    Right now kallsyms handling is not working with JITed subprogs.
    The reason is that when in 1c2a088a ("bpf: x64: add JIT support
    for multi-function programs") in jit_subprogs() they are passed
    to bpf_prog_kallsyms_add(), then their prog type is 0, which BPF
    core will think it's a cBPF program as only cBPF programs have a
    0 type. Thus, they need to inherit the type from the main prog.
    
    Once that is fixed, they are indeed added to the BPF kallsyms
    infra, but their tag is 0. Therefore, since intention is to add
    them as bpf_prog_F_<tag>, we need to pass them to bpf_prog_calc_tag()
    first. And once this is resolved, there is a use-after-free on
    prog cleanup: we remove the kallsyms entry from the main prog,
    later walk all subprogs and call bpf_jit_free() on them. However,
    the kallsyms linkage was never released on them. Thus, do that
    for all subprogs right in __bpf_prog_put() when refcount hits 0.
    
    Fixes: 1c2a088a ("bpf: x64: add JIT support for multi-function programs")
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    4f74d809
syscall.c 39.2 KB