* [PATCH] net: bpf: correctly handle errors in sk_attach_filter()
@ 2014-09-13 4:06 Sasha Levin
2014-09-13 9:12 ` Daniel Borkmann
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Sasha Levin @ 2014-09-13 4:06 UTC (permalink / raw)
To: davem
Cc: ast, keescook, hannes, dborkman, spender, netdev, linux-kernel,
Sasha Levin
Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
to be vmalloc()ed but never handled some of the errors paths of the old code.
On error within sk_attach_filter (which userspace can easily trigger), we'd
kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
net/core/filter.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index dfc716f..09e1c4a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1074,7 +1074,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
return -ENOMEM;
if (copy_from_user(prog->insns, fprog->filter, fsize)) {
- kfree(prog);
+ __bpf_prog_free(prog);
return -EFAULT;
}
@@ -1082,7 +1082,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
err = bpf_prog_store_orig_filter(prog, fprog);
if (err) {
- kfree(prog);
+ __bpf_prog_free(prog);
return -ENOMEM;
}
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] net: bpf: correctly handle errors in sk_attach_filter()
2014-09-13 4:06 [PATCH] net: bpf: correctly handle errors in sk_attach_filter() Sasha Levin
@ 2014-09-13 9:12 ` Daniel Borkmann
2014-09-13 9:24 ` Hannes Frederic Sowa
2014-09-13 21:38 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2014-09-13 9:12 UTC (permalink / raw)
To: Sasha Levin; +Cc: davem, ast, keescook, hannes, spender, netdev, linux-kernel
On 09/13/2014 06:06 AM, Sasha Levin wrote:
> Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
> to be vmalloc()ed but never handled some of the errors paths of the old code.
>
> On error within sk_attach_filter (which userspace can easily trigger), we'd
> kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
[ This patch is for net-next. ]
Acked-by: Daniel Borkmann <dborkman@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net: bpf: correctly handle errors in sk_attach_filter()
2014-09-13 4:06 [PATCH] net: bpf: correctly handle errors in sk_attach_filter() Sasha Levin
2014-09-13 9:12 ` Daniel Borkmann
@ 2014-09-13 9:24 ` Hannes Frederic Sowa
2014-09-13 21:38 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: Hannes Frederic Sowa @ 2014-09-13 9:24 UTC (permalink / raw)
To: Sasha Levin; +Cc: davem, ast, keescook, dborkman, spender, netdev, linux-kernel
On Sa, 2014-09-13 at 00:06 -0400, Sasha Levin wrote:
> Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
> to be vmalloc()ed but never handled some of the errors paths of the old code.
>
> On error within sk_attach_filter (which userspace can easily trigger), we'd
> kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Yeah, thanks, we missed that somehow.
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Bye,
Hannes
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] net: bpf: correctly handle errors in sk_attach_filter()
2014-09-13 4:06 [PATCH] net: bpf: correctly handle errors in sk_attach_filter() Sasha Levin
2014-09-13 9:12 ` Daniel Borkmann
2014-09-13 9:24 ` Hannes Frederic Sowa
@ 2014-09-13 21:38 ` David Miller
2 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2014-09-13 21:38 UTC (permalink / raw)
To: sasha.levin
Cc: ast, keescook, hannes, dborkman, spender, netdev, linux-kernel
From: Sasha Levin <sasha.levin@oracle.com>
Date: Sat, 13 Sep 2014 00:06:30 -0400
> Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
> to be vmalloc()ed but never handled some of the errors paths of the old code.
>
> On error within sk_attach_filter (which userspace can easily trigger), we'd
> kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.
>
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-09-13 21:38 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-13 4:06 [PATCH] net: bpf: correctly handle errors in sk_attach_filter() Sasha Levin
2014-09-13 9:12 ` Daniel Borkmann
2014-09-13 9:24 ` Hannes Frederic Sowa
2014-09-13 21:38 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.