bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
authorAlexei Starovoitov <ast@kernel.org>
Fri, 29 Mar 2024 17:14:39 +0000 (10:14 -0700)
committerAndrii Nakryiko <andrii@kernel.org>
Fri, 29 Mar 2024 18:10:41 +0000 (11:10 -0700)
commit59f2f841179aa6a0899cb9cf53659149a35749b7
tree6062529deb60350ea15098e82d721feda3661b6a
parent201874fc064ef14c26ea87a890b3f58296750d2d
bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.

syzbot reported the following lock sequence:
cpu 2:
  grabs timer_base lock
    spins on bpf_lpm lock

cpu 1:
  grab rcu krcp lock
    spins on timer_base lock

cpu 0:
  grab bpf_lpm lock
    spins on rcu krcp lock

bpf_lpm lock can be the same.
timer_base lock can also be the same due to timer migration.
but rcu krcp lock is always per-cpu, so it cannot be the same lock.
Hence it's a false positive.
To avoid lockdep complaining move kfree_rcu() after spin_unlock.

Reported-by: syzbot+1fa663a2100308ab6eab@syzkaller.appspotmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20240329171439.37813-1-alexei.starovoitov@gmail.com
kernel/bpf/lpm_trie.c