From patchwork Sat Sep 13 04:06:30 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sasha Levin X-Patchwork-Id: 388854 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 056B7140081 for ; Sat, 13 Sep 2014 14:07:29 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751062AbaIMEGu (ORCPT ); Sat, 13 Sep 2014 00:06:50 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:19161 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750769AbaIMEGt (ORCPT ); Sat, 13 Sep 2014 00:06:49 -0400 Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s8D46cKo002866 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sat, 13 Sep 2014 04:06:39 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s8D46Zcu018328 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 13 Sep 2014 04:06:36 GMT Received: from abhmp0017.oracle.com (abhmp0017.oracle.com [141.146.116.23]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s8D46ZJn011660; Sat, 13 Sep 2014 04:06:35 GMT Received: from lappy.hsd1.nh.comcast.net (/10.154.128.247) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 12 Sep 2014 21:06:34 -0700 From: Sasha Levin To: davem@davemloft.net Cc: ast@plumgrid.com, keescook@chromium.org, hannes@stressinduktion.org, dborkman@redhat.com, spender@grsecurity.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Sasha Levin Subject: [PATCH] net: bpf: correctly handle errors in sk_attach_filter() Date: Sat, 13 Sep 2014 00:06:30 -0400 Message-Id: <1410581190-31922-1-git-send-email-sasha.levin@oracle.com> X-Mailer: git-send-email 1.9.1 X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog to be vmalloc()ed but never handled some of the errors paths of the old code. On error within sk_attach_filter (which userspace can easily trigger), we'd kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct. Signed-off-by: Sasha Levin Acked-by: Daniel Borkmann Acked-by: Hannes Frederic Sowa --- net/core/filter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index dfc716f..09e1c4a 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -1074,7 +1074,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) return -ENOMEM; if (copy_from_user(prog->insns, fprog->filter, fsize)) { - kfree(prog); + __bpf_prog_free(prog); return -EFAULT; } @@ -1082,7 +1082,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk) err = bpf_prog_store_orig_filter(prog, fprog); if (err) { - kfree(prog); + __bpf_prog_free(prog); return -ENOMEM; }