Daniel Borkmann 3b4d9eb2ee bpf: Fix use after free in bpf_get_prog_name ... There is one more problematic case I noticed while recently fixing BPF kallsyms handling in cd7455f101 ("bpf: Fix use after free in subprog's jited symbol removal") and that is bpf_get_prog_name(). If BTF has been attached to the prog, then we may be able to fetch the function signature type id in kallsyms through prog->aux->func_info[prog->aux->func_idx].type_id. However, while the BTF object itself is torn down via RCU callback, the prog's aux->func_info is immediately freed via kvfree(prog->aux->func_info) once the prog's refcount either hit zero or when subprograms were already exposed via kallsyms and we hit the error path added in 5482e9a93c ("bpf: Fix memleak in aux->func_info and aux->btf"). This violates RCU as well since kallsyms could be walked in parallel where we could access aux->func_info. Hence, defer kvfree() to after RCU grace period. Looking at ba64e7d852 ("bpf: btf: support proper non-jit func info") there is no reason/dependency where we couldn't defer the kvfree(aux->func_info) into the RCU callback. Fixes: 5482e9a93c ("bpf: Fix memleak in aux->func_info and aux->btf") Fixes: ba64e7d852 ("bpf: btf: support proper non-jit func info") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Yonghong Song <yhs@fb.com> Cc: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/875f2906a7c1a0691f2d567b4d8e4ea2739b1e88.1571779205.git.daniel@iogearbox.net		2019-10-22 21:59:49 -07:00
..
arraymap.c
bpf_lru_list.c
bpf_lru_list.h
btf.c
cgroup.c
core.c	bpf: Fix use after free in subprog's jited symbol removal	2019-10-22 11:26:09 -07:00
cpumap.c
devmap.c
disasm.c
disasm.h
hashtab.c
helpers.c
inode.c
local_storage.c
lpm_trie.c
Makefile
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
queue_stack_maps.c
reuseport_array.c
stackmap.c
syscall.c	bpf: Fix use after free in bpf_get_prog_name	2019-10-22 21:59:49 -07:00
sysfs_btf.c
tnum.c
verifier.c
xskmap.c