| Message ID | 20201003002544.3601440-1-sdf@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1028ae4069991e26d1522e957939fb61d2da1d12 |
| Headers | show |
| Series | [bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used | expand |
On Fri, Oct 2, 2020 at 5:26 PM Stanislav Fomichev <sdf@google.com> wrote: > > We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP > on a map that's being already held by the program. > There is 'if (ret) bpf_map_put(map)' below which doesn't trigger > because we don't consider this an error. > Let's add missing bpf_map_put() for this specific condition. > > Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") > Reported-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Stanislav Fomichev <sdf@google.com> > --- Acked-by: Andrii Nakryiko <andriin@fb.com> > kernel/bpf/syscall.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index f1528c2a6927..1110ecd7d1f3 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr) > used_maps_old = prog->aux->used_maps; > > for (i = 0; i < prog->aux->used_map_cnt; i++) > - if (used_maps_old[i] == map) > + if (used_maps_old[i] == map) { > + bpf_map_put(map); > goto out_unlock; > + } > > used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1, > sizeof(used_maps_new[0]), > -- > 2.28.0.806.g8561365e88-goog >
On Fri, Oct 2, 2020 at 5:25 PM Stanislav Fomichev <sdf@google.com> wrote: > > We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP > on a map that's being already held by the program. > There is 'if (ret) bpf_map_put(map)' below which doesn't trigger > because we don't consider this an error. > Let's add missing bpf_map_put() for this specific condition. > > Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") > Reported-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Stanislav Fomichev <sdf@google.com> Thanks for the quick fix! Much appreciated.
Hello: This patch was applied to bpf/bpf-next.git (refs/heads/master): On Fri, 2 Oct 2020 17:25:44 -0700 you wrote: > We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP > on a map that's being already held by the program. > There is 'if (ret) bpf_map_put(map)' below which doesn't trigger > because we don't consider this an error. > Let's add missing bpf_map_put() for this specific condition. > > Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") > Reported-by: Alexei Starovoitov <ast@kernel.org> > Signed-off-by: Stanislav Fomichev <sdf@google.com> > > [...] Here is the summary with links: - [bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used https://git.kernel.org/bpf/bpf-next/c/1028ae406999 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f1528c2a6927..1110ecd7d1f3 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr) used_maps_old = prog->aux->used_maps; for (i = 0; i < prog->aux->used_map_cnt; i++) - if (used_maps_old[i] == map) + if (used_maps_old[i] == map) { + bpf_map_put(map); goto out_unlock; + } used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1, sizeof(used_maps_new[0]),
We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP on a map that's being already held by the program. There is 'if (ret) bpf_map_put(map)' below which doesn't trigger because we don't consider this an error. Let's add missing bpf_map_put() for this specific condition. Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall") Reported-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Stanislav Fomichev <sdf@google.com> --- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)