MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-12 20:35:23 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Revert "bpf: Fix a potential use-after-free in bpf_link_free()"

Browse Source 
This reverts commit 91cff53136 which is
commit 2884dc7d08 upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: I2356942c8740e7195f5ec2b91c5b15a055df8e74
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2024-06-22 09:14:47 +00:00
parent 4683195a6f
commit bf852b32cc
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
kernel/bpf/syscall.c
View File

@ -2832,7 +2832,6 @@ static int bpf_obj_get(const union bpf_attr *attr)
void bpf_link_init(struct bpf_link *link, enum bpf_link_type type, void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
const struct bpf_link_ops *ops, struct bpf_prog *prog) const struct bpf_link_ops *ops, struct bpf_prog *prog)
{ {
WARN_ON(ops->dealloc && ops->dealloc_deferred);
atomic64_set(&link->refcnt, 1); atomic64_set(&link->refcnt, 1);
link->type = type; link->type = type;
link->id = 0; link->id = 0;
@ -2891,17 +2890,16 @@ static void bpf_link_defer_dealloc_mult_rcu_gp(struct rcu_head *rcu)
/* bpf_link_free is guaranteed to be called from process context */ /* bpf_link_free is guaranteed to be called from process context */
static void bpf_link_free(struct bpf_link *link) static void bpf_link_free(struct bpf_link *link)
{ {
const struct bpf_link_ops *ops = link->ops;
bool sleepable = false; bool sleepable = false;
bpf_link_free_id(link->id); bpf_link_free_id(link->id);
if (link->prog) { if (link->prog) {
sleepable = link->prog->aux->sleepable; sleepable = link->prog->aux->sleepable;
/* detach BPF program, clean up used resources */ /* detach BPF program, clean up used resources */
ops->release(link); link->ops->release(link);
bpf_prog_put(link->prog); bpf_prog_put(link->prog);
} }
if (ops->dealloc_deferred) { if (link->ops->dealloc_deferred) {
/* schedule BPF link deallocation; if underlying BPF program /* schedule BPF link deallocation; if underlying BPF program
* is sleepable, we need to first wait for RCU tasks trace * is sleepable, we need to first wait for RCU tasks trace
* sync, then go through "classic" RCU grace period * sync, then go through "classic" RCU grace period
@ -2910,8 +2908,9 @@ static void bpf_link_free(struct bpf_link *link)
call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp); call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp);
else else
call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp); call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp);
} else if (ops->dealloc) }
ops->dealloc(link); if (link->ops->dealloc)
link->ops->dealloc(link);
} }
static void bpf_link_put_deferred(struct work_struct *work) static void bpf_link_put_deferred(struct work_struct *work)