| Message ID | 20221213175714.31963-1-milan@mdaverde.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 2958c237fd1ed4e184d5a6d1e545f8249ae4543b |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next] bpf: prevent leak of lsm program after failed attach | expand |
On Tue, Dec 13, 2022 at 9:58 AM Milan Landaverde <milan@mdaverde.com> wrote: > > In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, > but in our validation to make sure the prog is meant to be attached to > BPF_LSM_CGROUP, we return too early if the check fails. This results in > lack of decrementing prog's refcnt (through bpf_prog_put) > leaving the LSM program alive past the point of the expected lifecycle. > This fix allows for the decrement to take place. > > [0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/ > > Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") > Signed-off-by: Milan Landaverde <milan@mdaverde.com> Makes sense, thank you! Reviewed-by: Stanislav Fomichev <sdf@google.com> > --- > kernel/bpf/syscall.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index 35972afb6850..64131f88c553 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -3518,9 +3518,9 @@ static int bpf_prog_attach(const union bpf_attr *attr) > case BPF_PROG_TYPE_LSM: > if (ptype == BPF_PROG_TYPE_LSM && > prog->expected_attach_type != BPF_LSM_CGROUP) > - return -EINVAL; > - > - ret = cgroup_bpf_prog_attach(attr, ptype, prog); > + ret = -EINVAL; > + else > + ret = cgroup_bpf_prog_attach(attr, ptype, prog); > break; > default: > ret = -EINVAL; > -- > 2.34.1 >
Hello: This patch was applied to bpf/bpf-next.git (master) by Martin KaFai Lau <martin.lau@kernel.org>: On Tue, 13 Dec 2022 12:57:14 -0500 you wrote: > In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, > but in our validation to make sure the prog is meant to be attached to > BPF_LSM_CGROUP, we return too early if the check fails. This results in > lack of decrementing prog's refcnt (through bpf_prog_put) > leaving the LSM program alive past the point of the expected lifecycle. > This fix allows for the decrement to take place. > > [...] Here is the summary with links: - [bpf-next] bpf: prevent leak of lsm program after failed attach https://git.kernel.org/bpf/bpf-next/c/2958c237fd1e You are awesome, thank you!
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 35972afb6850..64131f88c553 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -3518,9 +3518,9 @@ static int bpf_prog_attach(const union bpf_attr *attr) case BPF_PROG_TYPE_LSM: if (ptype == BPF_PROG_TYPE_LSM && prog->expected_attach_type != BPF_LSM_CGROUP) - return -EINVAL; - - ret = cgroup_bpf_prog_attach(attr, ptype, prog); + ret = -EINVAL; + else + ret = cgroup_bpf_prog_attach(attr, ptype, prog); break; default: ret = -EINVAL;
In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, but in our validation to make sure the prog is meant to be attached to BPF_LSM_CGROUP, we return too early if the check fails. This results in lack of decrementing prog's refcnt (through bpf_prog_put) leaving the LSM program alive past the point of the expected lifecycle. This fix allows for the decrement to take place. [0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/ Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") Signed-off-by: Milan Landaverde <milan@mdaverde.com> --- kernel/bpf/syscall.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)