[PATCH v2 bpf-next] bpf: fix possible file descriptor leaks in verifier

[PATCH v2 bpf-next] bpf: fix possible file descriptor leaks in verifier

[Anton Protopopov]

The resolve_pseudo_ldimm64() function might have leaked file
descriptors when BPF_MAP_TYPE_ARENA was used in a program (some
error paths missed a corresponding fdput). Add missing fdputs.

v2:
  remove unrelated changes from the fix

Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
Signed-off-by: Anton Protopopov <aspsk@isovalent.com>
---
 kernel/bpf/verifier.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index edb650667f44..58952f040761 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -18383,15 +18383,18 @@ static int resolve_pseudo_ldimm64(struct bpf_verifier_env *env)
 				}
 				if (!env->prog->jit_requested) {
 					verbose(env, "JIT is required to use arena\n");
+					fdput(f);
 					return -EOPNOTSUPP;
 				}
 				if (!bpf_jit_supports_arena()) {
 					verbose(env, "JIT doesn't support arena\n");
+					fdput(f);
 					return -EOPNOTSUPP;
 				}
 				env->prog->aux->arena = (void *)map;
 				if (!bpf_arena_get_user_vm_start(env->prog->aux->arena)) {
 					verbose(env, "arena's user address must be set via map_extra or mmap()\n");
+					fdput(f);
 					return -EINVAL;
 				}
 			}
-- 
2.34.1

Re: [PATCH v2 bpf-next] bpf: fix possible file descriptor leaks in verifier

[Yonghong Song]

On 3/29/24 12:11 AM, Anton Protopopov wrote:
> The resolve_pseudo_ldimm64() function might have leaked file
> descriptors when BPF_MAP_TYPE_ARENA was used in a program (some
> error paths missed a corresponding fdput). Add missing fdputs.
>
> v2:
>    remove unrelated changes from the fix
>
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
> Signed-off-by: Anton Protopopov <aspsk@isovalent.com>

Thanks for the dedicated patch for the bug fix. LGTM.

Acked-by: Yonghong Song <yonghong.song@linux.dev>

Re: [PATCH v2 bpf-next] bpf: fix possible file descriptor leaks in verifier

[Shung-Hsi Yu]

On Fri, Mar 29, 2024 at 07:11:06AM +0000, Anton Protopopov wrote:
> The resolve_pseudo_ldimm64() function might have leaked file
> descriptors when BPF_MAP_TYPE_ARENA was used in a program (some
> error paths missed a corresponding fdput). Add missing fdputs.
> 
> v2:
>   remove unrelated changes from the fix
> 
> Fixes: 6082b6c328b5 ("bpf: Recognize addr_space_cast instruction in the verifier.")
> Signed-off-by: Anton Protopopov <aspsk@isovalent.com>

Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>

Re: [PATCH v2 bpf-next] bpf: fix possible file descriptor leaks in verifier

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Fri, 29 Mar 2024 07:11:06 +0000 you wrote:
> The resolve_pseudo_ldimm64() function might have leaked file
> descriptors when BPF_MAP_TYPE_ARENA was used in a program (some
> error paths missed a corresponding fdput). Add missing fdputs.
> 
> v2:
>   remove unrelated changes from the fix
> 
> [...]

Here is the summary with links:
  - [v2,bpf-next] bpf: fix possible file descriptor leaks in verifier
    https://git.kernel.org/bpf/bpf/c/6dae957c8eef

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html