From: Song Liu <firstname.lastname@example.org> To: Roman Gushchin <email@example.com> Cc: bpf <firstname.lastname@example.org>, Alexei Starovoitov <email@example.com>, Daniel Borkmann <firstname.lastname@example.org>, open list <email@example.com>, Kernel Team <firstname.lastname@example.org>, Networking <email@example.com>, firstname.lastname@example.org Subject: Re: [PATCH bpf] bpf: cgroup: prevent out-of-order release of cgroup bpf Date: Fri, 3 Jan 2020 09:47:01 -0800 [thread overview] Message-ID: <CAPhsuW7SKrS9WOVZXXoXjeGaFugUZmwip-m44gWAWyCbEkhBvA@mail.gmail.com> (raw) In-Reply-To: <email@example.com> On Fri, Dec 27, 2019 at 1:50 PM Roman Gushchin <firstname.lastname@example.org> wrote: > > Before commit 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf > from cgroup itself") cgroup bpf structures were released with > corresponding cgroup structures. It guaranteed the hierarchical order > of destruction: children were always first. It preserved attached > programs from being released before their propagated copies. > > But with cgroup auto-detachment there are no such guarantees anymore: > cgroup bpf is released as soon as the cgroup is offline and there are > no live associated sockets. It means that an attached program can be > detached and released, while its propagated copy is still living > in the cgroup subtree. This will obviously lead to an use-after-free > bug. > [...] > > Thanks to Josef Bacik for the debugging and the initial analysis of > the problem. > > Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself") > Reported-by: Josef Bacik <email@example.com> > Signed-off-by: Roman Gushchin <firstname.lastname@example.org> > Cc: Alexei Starovoitov <email@example.com> > Cc: firstname.lastname@example.org LGTM. Thanks for the fix! Acked-by: Song Liu <email@example.com>
next prev parent reply other threads:[~2020-01-03 17:47 UTC|newest] Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-12-27 21:50 Roman Gushchin 2020-01-03 15:30 ` Roman Gushchin 2020-01-03 17:47 ` Song Liu [this message] 2020-01-04 0:35 ` Alexei Starovoitov 2020-01-04 1:13 ` Roman Gushchin 2020-01-04 2:31 ` Alexei Starovoitov 2020-01-04 3:00 ` Roman Gushchin 2020-01-06 22:07 ` Alexei Starovoitov 2020-01-06 22:20 ` Roman Gushchin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAPhsuW7SKrS9WOVZXXoXjeGaFugUZmwip-m44gWAWyCbEkhBvA@mail.gmail.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --subject='Re: [PATCH bpf] bpf: cgroup: prevent out-of-order release of cgroup bpf' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).