diff options
| author | Jakub Sitnicki | 2019-08-21 14:17:20 +0200 |
|---|---|---|
| committer | Daniel Borkmann | 2019-08-24 01:15:34 +0200 |
| commit | db38de39684dda2bf307f41797db2831deba64e9 (patch) | |
| tree | af5b19557c1fda37db52a3cb3ffcee646b59fb3b /kernel/bpf | |
| parent | 3035bb72ee47d494c041465b4add9c6407c832ed (diff) | |
flow_dissector: Fix potential use-after-free on BPF_PROG_DETACH
Call to bpf_prog_put(), with help of call_rcu(), queues an RCU-callback to
free the program once a grace period has elapsed. The callback can run
together with new RCU readers that started after the last grace period.
New RCU readers can potentially see the "old" to-be-freed or already-freed
pointer to the program object before the RCU update-side NULLs it.
Reorder the operations so that the RCU update-side resets the protected
pointer before the end of the grace period after which the program will be
freed.
Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Reported-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Petar Penkov <ppenkov@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'kernel/bpf')
0 files changed, 0 insertions, 0 deletions