diff options
| author | Jakub Sitnicki <[email protected]> | 2019-08-21 14:17:20 +0200 |
|---|---|---|
| committer | Daniel Borkmann <[email protected]> | 2019-08-24 01:15:34 +0200 |
| commit | db38de39684dda2bf307f41797db2831deba64e9 (patch) | |
| tree | af5b19557c1fda37db52a3cb3ffcee646b59fb3b /kernel/bpf/syscall.c | |
| parent | 3035bb72ee47d494c041465b4add9c6407c832ed (diff) | |
flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH
Call to bpf_prog_put(), with help of call_rcu(), queues an RCU-callback to
free the program once a grace period has elapsed. The callback can run
together with new RCU readers that started after the last grace period.
New RCU readers can potentially see the "old" to-be-freed or already-freed
pointer to the program object before the RCU update-side NULLs it.
Reorder the operations so that the RCU update-side resets the protected
pointer before the end of the grace period after which the program will be
freed.
Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Reported-by: Lorenz Bauer <[email protected]>
Signed-off-by: Jakub Sitnicki <[email protected]>
Acked-by: Petar Penkov <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>
Diffstat (limited to 'kernel/bpf/syscall.c')
0 files changed, 0 insertions, 0 deletions