lkml.org 
[lkml]   [2021]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 10/33] bpf: Dont leak memory in bpf getsockopt when optlen == 0
    Date
    From: Stanislav Fomichev <sdf@google.com>

    commit 4be34f3d0731b38a1b24566b37fbb39500aaf3a2 upstream.

    optlen == 0 indicates that the kernel should ignore BPF buffer
    and use the original one from the user. We, however, forget
    to free the temporary buffer that we've allocated for BPF.

    Fixes: d8fe449a9c51 ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE")
    Reported-by: Martin KaFai Lau <kafai@fb.com>
    Signed-off-by: Stanislav Fomichev <sdf@google.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Martin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/bpf/20210112162829.775079-1-sdf@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/bpf/cgroup.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/kernel/bpf/cgroup.c
    +++ b/kernel/bpf/cgroup.c
    @@ -1057,12 +1057,13 @@ int __cgroup_bpf_run_filter_setsockopt(s
    if (ctx.optlen != 0) {
    *optlen = ctx.optlen;
    *kernel_optval = ctx.optval;
    + /* export and don't free sockopt buf */
    + return 0;
    }
    }

    out:
    - if (ret)
    - sockopt_free_buf(&ctx);
    + sockopt_free_buf(&ctx);
    return ret;
    }
    EXPORT_SYMBOL(__cgroup_bpf_run_filter_setsockopt);

    \
     
     \ /
      Last update: 2021-01-22 19:53    [W:2.139 / U:0.912 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site