bpf: don't leak memory in bpf getsockopt when optlen == 0
Subsystems (3)
PATCH v2 1/1 bpf: don't leak memory in bpf getsockopt when optlen == 0
optlen == 0 indicates that the kernel should ignore BPF buffer and use the original one from the user. We, however, forget to free the temporary buffer that we've allocated for BPF.
--- kernel/bpf/cgroup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/bpf/cgroup.c +3 -2
@@ -1391,12 +1391,13 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level,if (ctx.optlen !=0 ) { *optlen = ctx.optlen; *kernel_optval = ctx.optval; +/* export and don't free sockopt buf */ +return 0 ; } } out: -if (ret) -sockopt_free_buf (&ctx); +sockopt_free_buf (&ctx);return ret; }
Signature · 1 line
2.30.0.284.gd98b1dd5eaa7-goog
Quoted 3 lines · Stanislav Fomichev
optlen == 0 indicates that the kernel should ignore BPF buffer and use the original one from the user. We, however, forget to free the temporary buffer that we've allocated for BPF.
This patch was applied to bpf/bpf.git (refs/heads/master):
Hello:
This patch was applied to bpf/bpf.git (refs/heads/master):
Quoted 9 lines · On Tue, 12 Jan 2021 08:28:29 -0800 you wrote:
optlen == 0 indicates that the kernel should ignore BPF buffer and use the original one from the user. We, however, forget to free the temporary buffer that we've allocated for BPF.
Reported-by Martin KaFai Lau <[email protected]>Fixes d8fe449a9c51 ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE")Signed-off-by Stanislav Fomichev <[email protected]>[...]
Here is the summary with links:
- [bpf,v2] bpf: don't leak memory in bpf getsockopt when optlen == 0
https://git.kernel.org/bpf/bpf/c/4be34f3d0731
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html