Cong Wang 2884dc7d08 bpf: Fix a potential use-after-free in bpf_link_free() ... After commit 1a80dbcb2d, bpf_link can be freed by link->ops->dealloc_deferred, but the code still tests and uses link->ops->dealloc afterward, which leads to a use-after-free as reported by syzbot. Actually, one of them should be sufficient, so just call one of them instead of both. Also add a WARN_ON() in case of any problematic implementation. Fixes: 1a80dbcb2d ("bpf: support deferring bpf_link dealloc to after RCU grace period") Reported-by: syzbot+1989ee16d94720836244@syzkaller.appspotmail.com Signed-off-by: Cong Wang <cong.wang@bytedance.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20240602182703.207276-1-xiyou.wangcong@gmail.com		2024-06-03 18:16:19 +02:00
..
preload	…
Kconfig	…
Makefile	…
arena.c	The usual shower of singleton fixes and minor series all over MM,	2024-05-19 09:21:03 -07:00
arraymap.c	…
bloom_filter.c	…
bpf_cgrp_storage.c	…
bpf_inode_storage.c	…
bpf_iter.c	…
bpf_local_storage.c	…
bpf_lru_list.c	…
bpf_lru_list.h	…
bpf_lsm.c	…
bpf_struct_ops.c	…
bpf_task_storage.c	…
btf.c	…
cgroup.c	…
cgroup_iter.c	…
core.c	…
cpumap.c	…
cpumask.c	…
crypto.c	…
devmap.c	bpf, devmap: Remove unnecessary if check in for loop	2024-06-03 17:09:23 +02:00
disasm.c	…
disasm.h	…
dispatcher.c	…
hashtab.c	…
helpers.c	…
inode.c	…
link_iter.c	…
local_storage.c	…
log.c	…
lpm_trie.c	…
map_in_map.c	…
map_in_map.h	…
map_iter.c	…
memalloc.c	…
mmap_unlock_work.h	…
mprog.c	…
net_namespace.c	…
offload.c	…
percpu_freelist.c	…
percpu_freelist.h	…
prog_iter.c	…
queue_stack_maps.c	…
reuseport_array.c	…
ringbuf.c	…
stackmap.c	…
syscall.c	bpf: Fix a potential use-after-free in bpf_link_free()	2024-06-03 18:16:19 +02:00
sysfs_btf.c	…
task_iter.c	…
tcx.c	…
tnum.c	…
token.c	…
trampoline.c	…
verifier.c	bpf: Fix bpf_session_cookie BTF_ID in special_kfunc_set list	2024-05-31 14:54:48 -07:00