| Message ID | 20201003002544.3601440-1-sdf@google.com |
|---|---|
| State | New |
| Headers | show |
| Series | [bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used | expand |
On Fri, Oct 2, 2020 at 5:26 PM Stanislav Fomichev <sdf@google.com> wrote: > > We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP > on a map that's being already held by the program. > There is 'if (ret) bpf_map_put(map)' below which doesn't trigger > because we don't consider this an error. > Let's add missing bpf_map_put() for this specific condition. > > Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") > Reported-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Stanislav Fomichev <sdf@google.com> > --- Acked-by: Andrii Nakryiko <andriin@fb.com> > kernel/bpf/syscall.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index f1528c2a6927..1110ecd7d1f3 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr) > used_maps_old = prog->aux->used_maps; > > for (i = 0; i < prog->aux->used_map_cnt; i++) > - if (used_maps_old[i] == map) > + if (used_maps_old[i] == map) { > + bpf_map_put(map); > goto out_unlock; > + } > > used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1, > sizeof(used_maps_new[0]), > -- > 2.28.0.806.g8561365e88-goog >
On Fri, Oct 2, 2020 at 5:25 PM Stanislav Fomichev <sdf@google.com> wrote: > > We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP > on a map that's being already held by the program. > There is 'if (ret) bpf_map_put(map)' below which doesn't trigger > because we don't consider this an error. > Let's add missing bpf_map_put() for this specific condition. > > Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") > Reported-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Stanislav Fomichev <sdf@google.com> Thanks for the quick fix! Much appreciated.
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f1528c2a6927..1110ecd7d1f3 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr) used_maps_old = prog->aux->used_maps; for (i = 0; i < prog->aux->used_map_cnt; i++) - if (used_maps_old[i] == map) + if (used_maps_old[i] == map) { + bpf_map_put(map); goto out_unlock; + } used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1, sizeof(used_maps_new[0]),
We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP on a map that's being already held by the program. There is 'if (ret) bpf_map_put(map)' below which doesn't trigger because we don't consider this an error. Let's add missing bpf_map_put() for this specific condition. Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") Reported-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Stanislav Fomichev <sdf@google.com> --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)