bpf: media: properly use bpf_prog_array api

Now that we don't have __rcu markers on the bpf_prog_array helpers,
let's use proper rcu_dereference_protected to obtain array pointer
under mutex.

Cc: linux-media@vger.kernel.org
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Sean Young <sean@mess.org>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
index ee65700..0a0ce62 100644 (file)
--- a/drivers/media/rc/bpf-lirc.c
+++ b/drivers/media/rc/bpf-lirc.c
@@ -8,6 +8,9 @@
 #include <linux/bpf_lirc.h>
 #include "rc-core-priv.h"
 
+#define lirc_rcu_dereference(p)                                                \
+       rcu_dereference_protected(p, lockdep_is_held(&ir_raw_handler_lock))
+
 /*
  * BPF interface for raw IR
  */
@@ -136,7 +139,7 @@ const struct bpf_verifier_ops lirc_mode2_verifier_ops = {
 
 static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)
 {
-       struct bpf_prog_array __rcu *old_array;
+       struct bpf_prog_array *old_array;
        struct bpf_prog_array *new_array;
        struct ir_raw_event_ctrl *raw;
        int ret;
@@ -154,12 +157,12 @@ static int lirc_bpf_attach(struct rc_dev *rcdev, struct bpf_prog *prog)
                goto unlock;
        }
 
-       if (raw->progs && bpf_prog_array_length(raw->progs) >= BPF_MAX_PROGS) {
+       old_array = lirc_rcu_dereference(raw->progs);
+       if (old_array && bpf_prog_array_length(old_array) >= BPF_MAX_PROGS) {
                ret = -E2BIG;
                goto unlock;
        }
 
-       old_array = raw->progs;
        ret = bpf_prog_array_copy(old_array, NULL, prog, &new_array);
        if (ret < 0)
                goto unlock;
@@ -174,7 +177,7 @@ unlock:
 
 static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
 {
-       struct bpf_prog_array __rcu *old_array;
+       struct bpf_prog_array *old_array;
        struct bpf_prog_array *new_array;
        struct ir_raw_event_ctrl *raw;
        int ret;
@@ -192,7 +195,7 @@ static int lirc_bpf_detach(struct rc_dev *rcdev, struct bpf_prog *prog)
                goto unlock;
        }
 
-       old_array = raw->progs;
+       old_array = lirc_rcu_dereference(raw->progs);
        ret = bpf_prog_array_copy(old_array, prog, NULL, &new_array);
        /*
         * Do not use bpf_prog_array_delete_safe() as we would end up
@@ -223,21 +226,22 @@ void lirc_bpf_run(struct rc_dev *rcdev, u32 sample)
 /*
  * This should be called once the rc thread has been stopped, so there can be
  * no concurrent bpf execution.
+ *
+ * Should be called with the ir_raw_handler_lock held.
  */
 void lirc_bpf_free(struct rc_dev *rcdev)
 {
        struct bpf_prog_array_item *item;
+       struct bpf_prog_array *array;
 
-       if (!rcdev->raw->progs)
+       array = lirc_rcu_dereference(rcdev->raw->progs);
+       if (!array)
                return;
 
-       item = rcu_dereference(rcdev->raw->progs)->items;
-       while (item->prog) {
+       for (item = array->items; item->prog; item++)
                bpf_prog_put(item->prog);
-               item++;
-       }
 
-       bpf_prog_array_free(rcdev->raw->progs);
+       bpf_prog_array_free(array);
 }
 
 int lirc_prog_attach(const union bpf_attr *attr, struct bpf_prog *prog)
@@ -290,7 +294,7 @@ int lirc_prog_detach(const union bpf_attr *attr)
 int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
 {
        __u32 __user *prog_ids = u64_to_user_ptr(attr->query.prog_ids);
-       struct bpf_prog_array __rcu *progs;
+       struct bpf_prog_array *progs;
        struct rc_dev *rcdev;
        u32 cnt, flags = 0;
        int ret;
@@ -311,7 +315,7 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
        if (ret)
                goto put;
 
-       progs = rcdev->raw->progs;
+       progs = lirc_rcu_dereference(rcdev->raw->progs);
        cnt = progs ? bpf_prog_array_length(progs) : 0;
 
        if (copy_to_user(&uattr->query.prog_cnt, &cnt, sizeof(cnt))) {