netdev - Re: [PATCH 1/2] bpf: sockmap, double free in __sock_map_ctx_update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 May 2018 10:27:18 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Dan Carpenter <dan.carpenter@...cle.com>,
        Alexei Starovoitov <ast@...nel.org>,
        John Fastabend <john.fastabend@...il.com>
Cc:     netdev@...r.kernel.org, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH 1/2] bpf: sockmap, double free in
 __sock_map_ctx_update_elem()

Hi Dan,

On 05/18/2018 09:58 AM, Dan Carpenter wrote:
> We accidentally free "e" twice.
> 
> Fixes: 81110384441a ("bpf: sockmap, add hash map support")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> 
> diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
> index c6de1393df63..216d5c9b0eb3 100644
> --- a/kernel/bpf/sockmap.c
> +++ b/kernel/bpf/sockmap.c
> @@ -1833,7 +1833,6 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map,
>  	if (tx_msg)
>  		bpf_prog_put(tx_msg);
>  	write_unlock_bh(&sock->sk_callback_lock);
> -	kfree(e);
>  	return err;
>  }

Thanks for the two fixes, appreciate it! There were two similar ones that
fix the same issues which were already applied yesterday to bpf-next:

https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=0e4364560361d57e8cd873a8990327f3471d7d8a
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=a78622932c27e8ec33e5ba180f3d2e87fb806b28