netdev - Re: [PATCH net] ebpf: fix fd refcount leaks related to maps in bpf syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 09 Sep 2015 12:39:52 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	daniel@...earbox.net
Cc:	ast@...mgrid.com, netdev@...r.kernel.org
Subject: Re: [PATCH net] ebpf: fix fd refcount leaks related to maps in bpf
 syscall

From: Daniel Borkmann <daniel@...earbox.net>
Date: Tue,  8 Sep 2015 18:00:09 +0200

> We may already have gotten a proper fd struct through fdget(), so
> whenever we return at the end of an map operation, we need to call
> fdput(). However, each map operation from syscall side first probes
> CHECK_ATTR() to verify that unused fields in the bpf_attr union are
> zero.
> 
> In case of malformed input, we return with error, but the lookup to
> the map_fd was already performed at that time, so that we return
> without an corresponding fdput(). Fix it by performing an fdget()
> only right before bpf_map_get(). The fdget() invocation on maps in
> the verifier is not affected.
> 
> Fixes: db20fd2b0108 ("bpf: add lookup/update/delete/iterate methods to BPF maps")
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> Acked-by: Alexei Starovoitov <ast@...mgrid.com>

Applied, thanks Daniel.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html