Re: [PATCH bpf-next v2 0/2] bpf: Invalidate RCU pointers after final spin unlock

Ning Ding <[email protected]> writes:

> In a sleepable BPF program, a spin lock can provide the only RCU protection
> for a kptr. The final spin unlock ends that protection, but the verifier
> leaves the pointer valid. Another CPU can then free the object before the
> pointer is used. A capability-limited runtime PoC triggered a
> KASAN-confirmed task_struct use-after-free.
>
> Patch 1 invalidates RCU-protected pointers only when an unlock leaves the
> final RCU-protected context. Patch 2 adds a negative sleepable test and
> positive controls for non-sleepable and explicit-RCU contexts.

I think if we are doing this we should do it for all things that act as
an entry to a RCU read side critical section [1]:

1. Disabling preemption
2. Disabling bottom halves
3. Disabling interrupts
4. Acquiring a spin lock

As you are doing it for 4, can you also do it for 1 and 3? I don't think
BPF can disable bottom halves right now.

Paul, can you ack this? Let us know if there are more things that can
make a BPF program enter a read side critical section.

Thanks,
Puranjay

[1] https://docs.kernel.org/RCU/whatisRCU.html#:~:text=Note%20that%20anything,side%20critical%20sections.