* [PATCH bpf-next] bpf: Fix error path under memory pressure
@ 2020-01-22 2:41 Alexei Starovoitov
2020-01-22 2:45 ` Alexei Starovoitov
0 siblings, 1 reply; 4+ messages in thread
From: Alexei Starovoitov @ 2020-01-22 2:41 UTC (permalink / raw)
To: davem; +Cc: daniel, netdev, bpf, kernel-team
Restore the 'if (env->cur_state)' check that was incorrectly removed during
code move. Under memory pressure env->cur_state can be freed and zeroed inside
do_check(). Hence the check is necessary.
Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
kernel/bpf/verifier.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ca17dccc17ba..6defbec9eb62 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9594,8 +9594,13 @@ static int do_check_common(struct bpf_verifier_env *env, int subprog)
ret = do_check(env);
out:
- free_verifier_state(env->cur_state, true);
- env->cur_state = NULL;
+ /* check for NULL is necessary, since cur_state can be freed inside
+ * do_check() under memory pressure.
+ */
+ if (env->cur_state) {
+ free_verifier_state(env->cur_state, true);
+ env->cur_state = NULL;
+ }
while (!pop_stack(env, NULL, NULL));
free_states(env);
if (ret)
--
2.23.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH bpf-next] bpf: Fix error path under memory pressure
2020-01-22 2:41 [PATCH bpf-next] bpf: Fix error path under memory pressure Alexei Starovoitov
@ 2020-01-22 2:45 ` Alexei Starovoitov
2020-01-22 6:56 ` Song Liu
2020-01-22 15:56 ` Daniel Borkmann
0 siblings, 2 replies; 4+ messages in thread
From: Alexei Starovoitov @ 2020-01-22 2:45 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: David S. Miller, Daniel Borkmann, Network Development, bpf, Kernel Team
On Tue, Jan 21, 2020 at 6:42 PM Alexei Starovoitov <ast@kernel.org> wrote:
>
> Restore the 'if (env->cur_state)' check that was incorrectly removed during
> code move. Under memory pressure env->cur_state can be freed and zeroed inside
> do_check(). Hence the check is necessary.
>
> Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Forgot to add:
Reported-by: syzbot+b296579ba5015704d9fa@syzkaller.appspotmail.com
Daniel, pls add while applying.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH bpf-next] bpf: Fix error path under memory pressure
2020-01-22 2:45 ` Alexei Starovoitov
@ 2020-01-22 6:56 ` Song Liu
2020-01-22 15:56 ` Daniel Borkmann
1 sibling, 0 replies; 4+ messages in thread
From: Song Liu @ 2020-01-22 6:56 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, David S. Miller, Daniel Borkmann,
Network Development, bpf, Kernel Team
> On Jan 21, 2020, at 6:45 PM, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>
> On Tue, Jan 21, 2020 at 6:42 PM Alexei Starovoitov <ast@kernel.org> wrote:
>>
>> Restore the 'if (env->cur_state)' check that was incorrectly removed during
>> code move. Under memory pressure env->cur_state can be freed and zeroed inside
>> do_check(). Hence the check is necessary.
>>
>> Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>
> Forgot to add:
> Reported-by: syzbot+b296579ba5015704d9fa@syzkaller.appspotmail.com
>
> Daniel, pls add while applying.
Acked-by: Song Liu <songliubraving@fb.com>
Thanks for the fix!
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH bpf-next] bpf: Fix error path under memory pressure
2020-01-22 2:45 ` Alexei Starovoitov
2020-01-22 6:56 ` Song Liu
@ 2020-01-22 15:56 ` Daniel Borkmann
1 sibling, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2020-01-22 15:56 UTC (permalink / raw)
To: Alexei Starovoitov, Alexei Starovoitov
Cc: David S. Miller, Network Development, bpf, Kernel Team
On 1/22/20 3:45 AM, Alexei Starovoitov wrote:
> On Tue, Jan 21, 2020 at 6:42 PM Alexei Starovoitov <ast@kernel.org> wrote:
>>
>> Restore the 'if (env->cur_state)' check that was incorrectly removed during
>> code move. Under memory pressure env->cur_state can be freed and zeroed inside
>> do_check(). Hence the check is necessary.
>>
>> Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>
> Forgot to add:
> Reported-by: syzbot+b296579ba5015704d9fa@syzkaller.appspotmail.com
>
> Daniel, pls add while applying.
Done & applied, thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-01-22 15:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-22 2:41 [PATCH bpf-next] bpf: Fix error path under memory pressure Alexei Starovoitov
2020-01-22 2:45 ` Alexei Starovoitov
2020-01-22 6:56 ` Song Liu
2020-01-22 15:56 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).