[PATCH bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used

[PATCH bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used

[Stanislav Fomichev]

We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP
on a map that's being already held by the program.
There is 'if (ret) bpf_map_put(map)' below which doesn't trigger
because we don't consider this an error.
Let's add missing bpf_map_put() for this specific condition.

Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall")
Reported-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
 kernel/bpf/syscall.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index f1528c2a6927..1110ecd7d1f3 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr)
 	used_maps_old = prog->aux->used_maps;
 
 	for (i = 0; i < prog->aux->used_map_cnt; i++)
-		if (used_maps_old[i] == map)
+		if (used_maps_old[i] == map) {
+			bpf_map_put(map);
 			goto out_unlock;
+		}
 
 	used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1,
 				      sizeof(used_maps_new[0]),
-- 
2.28.0.806.g8561365e88-goog

Re: [PATCH bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used

[Andrii Nakryiko]

On Fri, Oct 2, 2020 at 5:26 PM Stanislav Fomichev <sdf@google.com> wrote:
>
> We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP
> on a map that's being already held by the program.
> There is 'if (ret) bpf_map_put(map)' below which doesn't trigger
> because we don't consider this an error.
> Let's add missing bpf_map_put() for this specific condition.
>
> Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall")
> Reported-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
> ---

Acked-by: Andrii Nakryiko <andriin@fb.com>

>  kernel/bpf/syscall.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index f1528c2a6927..1110ecd7d1f3 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -4323,8 +4323,10 @@ static int bpf_prog_bind_map(union bpf_attr *attr)
>         used_maps_old = prog->aux->used_maps;
>
>         for (i = 0; i < prog->aux->used_map_cnt; i++)
> -               if (used_maps_old[i] == map)
> +               if (used_maps_old[i] == map) {
> +                       bpf_map_put(map);
>                         goto out_unlock;
> +               }
>
>         used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1,
>                                       sizeof(used_maps_new[0]),
> --
> 2.28.0.806.g8561365e88-goog
>

Re: [PATCH bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used

[Alexei Starovoitov]

On Fri, Oct 2, 2020 at 5:25 PM Stanislav Fomichev <sdf@google.com> wrote:
>
> We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP
> on a map that's being already held by the program.
> There is 'if (ret) bpf_map_put(map)' below which doesn't trigger
> because we don't consider this an error.
> Let's add missing bpf_map_put() for this specific condition.
>
> Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall")
> Reported-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Stanislav Fomichev <sdf@google.com>

Thanks for the quick fix! Much appreciated.

Re: [PATCH bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used

[patchwork-bot+bpf]

Hello:

This patch was applied to bpf/bpf-next.git (refs/heads/master):

On Fri,  2 Oct 2020 17:25:44 -0700 you wrote:
> We are missing a deref for the case when we are doing BPF_PROG_BIND_MAP
> on a map that's being already held by the program.
> There is 'if (ret) bpf_map_put(map)' below which doesn't trigger
> because we don't consider this an error.
> Let's add missing bpf_map_put() for this specific condition.
> 
> Fixes: ef15314aa5de ("bpf: Add BPF_PROG_BIND_MAP syscall")
> Reported-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: deref map in BPF_PROG_BIND_MAP when it's already used
    https://git.kernel.org/bpf/bpf-next/c/1028ae406999

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html