Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02205d2e authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Daniel Borkmann
Browse files

bpf: media: properly use bpf_prog_array api 



Now that we don't have __rcu markers on the bpf_prog_array helpers,
let's use proper rcu_dereference_protected to obtain array pointer
under mutex.

Cc: linux-media@vger.kernel.org
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Sean Young <sean@mess.org>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent 54e9c9d4

drivers/media/rc/bpf-lirc.c

+17 −13
Original line number Diff line number Diff line
@@ -8,6 +8,9 @@ 
#include <linux/bpf_lirc.h>

#include "rc-core-priv.h"



#define lirc_rcu_dereference(p)						\

	rcu_dereference_protected(p, lockdep_is_held(&ir_raw_handler_lock))



/*

 * BPF interface for raw IR

 */
@@ -136,7 +139,7 @@ const struct bpf_verifier_ops lirc_mode2_verifier_ops = { 


static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)

{

	struct bpf_prog_array __rcu *old_array;

	struct bpf_prog_array *old_array;

	struct bpf_prog_array *new_array;

	struct ir_raw_event_ctrl *raw;

	int ret;
@@ -154,12 +157,12 @@ static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog) 
		goto unlock;

	}



	if (raw->progs && bpf_prog_array_length(raw->progs) >= BPF_MAX_PROGS) {

	old_array = lirc_rcu_dereference(raw->progs);

	if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {

		ret = -E2BIG;

		goto unlock;

	}



	old_array = raw->progs;

	ret = bpf_prog_array_copy(old_array, NULL, prog, &new_array);

	if (ret < 0)

		goto unlock;
@@ -174,7 +177,7 @@ static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog) 


static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)

{

	struct bpf_prog_array __rcu *old_array;

	struct bpf_prog_array *old_array;

	struct bpf_prog_array *new_array;

	struct ir_raw_event_ctrl *raw;

	int ret;
@@ -192,7 +195,7 @@ static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog) 
		goto unlock;

	}



	old_array = raw->progs;

	old_array = lirc_rcu_dereference(raw->progs);

	ret = bpf_prog_array_copy(old_array, prog, NULL, &new_array);

	/*

	 * Do not use bpf_prog_array_delete_safe() as we would end up
@@ -223,21 +226,22 @@ void lirc_bpf_run(struct rc_dev *rcdev, u32 sample) 
/*

 * This should be called once the rc thread has been stopped, so there can be

 * no concurrent bpf execution.

 *

 * Should be called with the ir_raw_handler_lock held.

 */

void lirc_bpf_free(struct rc_dev *rcdev)

{

	struct bpf_prog_array_item *item;

	struct bpf_prog_array *array;



	if (!rcdev->raw->progs)

	array = lirc_rcu_dereference(rcdev->raw->progs);

	if (!array)

		return;



	item = rcu_dereference(rcdev->raw->progs)->items;

	while (item->prog) {

	for (item = array->items; item->prog; item++)

		bpf_prog_put(item->prog);

		item++;

	}



	bpf_prog_array_free(rcdev->raw->progs);

	bpf_prog_array_free(array);

}



int lirc_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
@@ -290,7 +294,7 @@ int lirc_prog_detach(const union bpf_attr *attr) 
int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)

{

	__u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);

	struct bpf_prog_array __rcu *progs;

	struct bpf_prog_array *progs;

	struct rc_dev *rcdev;

	u32 cnt, flags = 0;

	int ret;
@@ -311,7 +315,7 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr) 
	if (ret)

		goto put;



	progs = rcdev->raw->progs;

	progs = lirc_rcu_dereference(rcdev->raw->progs);

	cnt = progs ? bpf_prog_array_length(progs) : 0;



	if (copy_to_user(&uattr->query.prog_cnt, &cnt, sizeof(cnt))) {