summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDaniel Borkmann <daniel@iogearbox.net>2015-09-08 18:00:09 +0200
committerDavid S. Miller <davem@davemloft.net>2015-09-09 12:39:34 -0700
commit592867bfabe2fcb449393ba7eb0de4f972a08c63 (patch)
treefe34e9afb9076fab7d81b95613b96436e547fa50 /net
parent74e98eb085889b0d2d4908f59f6e00026063014f (diff)
downloadlinux-592867bfabe2fcb449393ba7eb0de4f972a08c63.tar.gz
linux-592867bfabe2fcb449393ba7eb0de4f972a08c63.tar.bz2
linux-592867bfabe2fcb449393ba7eb0de4f972a08c63.zip
ebpf: fix fd refcount leaks related to maps in bpf syscall
We may already have gotten a proper fd struct through fdget(), so whenever we return at the end of an map operation, we need to call fdput(). However, each map operation from syscall side first probes CHECK_ATTR() to verify that unused fields in the bpf_attr union are zero. In case of malformed input, we return with error, but the lookup to the map_fd was already performed at that time, so that we return without an corresponding fdput(). Fix it by performing an fdget() only right before bpf_map_get(). The fdget() invocation on maps in the verifier is not affected. Fixes: db20fd2b0108 ("bpf: add lookup/update/delete/iterate methods to BPF maps") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions