• Martin KaFai Lau's avatar
    bpf: btf: Avoid WARN_ON when CONFIG_REFCOUNT_FULL=y · 82e96972
    Martin KaFai Lau authored
    If CONFIG_REFCOUNT_FULL=y, refcount_inc() WARN when refcount is 0.
    When creating a new btf, the initial btf->refcnt is 0 and
    triggered the following:
    
    [   34.855452] refcount_t: increment on 0; use-after-free.
    [   34.856252] WARNING: CPU: 6 PID: 1857 at lib/refcount.c:153 refcount_inc+0x26/0x30
    ....
    [   34.868809] Call Trace:
    [   34.869168]  btf_new_fd+0x1af6/0x24d0
    [   34.869645]  ? btf_type_seq_show+0x200/0x200
    [   34.870212]  ? lock_acquire+0x3b0/0x3b0
    [   34.870726]  ? security_capable+0x54/0x90
    [   34.871247]  __x64_sys_bpf+0x1b2/0x310
    [   34.871761]  ? __ia32_sys_bpf+0x310/0x310
    [   34.872285]  ? bad_area_access_error+0x310/0x310
    [   34.872894]  do_syscall_64+0x95/0x3f0
    
    This patch uses refcount_set() instead.
    Reported-by: default avatarYonghong Song <yhs@fb.com>
    Tested-by: default avatarYonghong Song <yhs@fb.com>
    Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Acked-by: default avatarSong Liu <songliubraving@fb.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    82e96972
btf.c 51.4 KB