Commit c0d1379a authored Sep 13, 2014 by Sasha Levin Committed by David S. Miller Sep 13, 2014

net: bpf: correctly handle errors in sk_attach_filter()

Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
to be vmalloc()ed but never handled some of the errors paths of the old code.

On error within sk_attach_filter (which userspace can easily trigger), we'd
kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3fc88677

net/core/filter.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1047,7 +1047,7 @@ int sk_attach_filter(struct sock_fprog fprog, struct sock sk)
		return -ENOMEM;

		if (copy_from_user(prog->insns, fprog->filter, fsize)) {
		kfree(prog);
		__bpf_prog_free(prog);
		return -EFAULT;
		}

		@@ -1055,7 +1055,7 @@ int sk_attach_filter(struct sock_fprog fprog, struct sock sk)

		err = bpf_prog_store_orig_filter(prog, fprog);
		if (err) {
		kfree(prog);
		__bpf_prog_free(prog);
		return -ENOMEM;
		}