Andrii Nakryiko 138c67677f bpf: Fix use-after-free of bpf_link when priming half-fails ... If bpf_link_prime() succeeds to allocate new anon file, but then fails to allocate ID for it, link priming is considered to be failed and user is supposed ot be able to directly kfree() bpf_link, because it was never exposed to user-space. But at that point file already keeps a pointer to bpf_link and will eventually call bpf_link_release(), so if bpf_link was kfree()'d by caller, that would lead to use-after-free. Fix this by first allocating ID and only then allocating file. Adding ID to link_idr is ok, because link at that point still doesn't have its ID set, so no user-space process can create a new FD for it. Fixes: a3b80e1078 ("bpf: Allocate ID for bpf_link") Reported-by: syzbot+39b64425f91b5aab714d@syzkaller.appspotmail.com Suggested-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Andrii Nakryiko <andriin@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Martin KaFai Lau <kafai@fb.com> Link: https://lore.kernel.org/bpf/20200501185622.3088964-1-andriin@fb.com		2020-05-01 15:13:05 -07:00
..
bpf	bpf: Fix use-after-free of bpf_link when priming half-fails	2020-05-01 15:13:05 -07:00
cgroup	bpf: Refactor bpf_link update handling	2020-04-28 17:27:07 -07:00
configs	compiler: remove CONFIG_OPTIMIZE_INLINING entirely	2020-04-07 10:43:42 -07:00
debug
dma	dma-debug: fix displaying of dma allocation type	2020-04-08 21:46:57 +02:00
events	Merge branch 'work.sysctl' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-28 21:23:38 +02:00
gcov	kernel/gcov/fs.c: gcov_seq_next() should increase position index	2020-04-10 15:36:22 -07:00
irq	genirq: Remove setup_irq() and remove_irq()	2020-04-14 10:08:50 +02:00
livepatch
locking	locking/lockdep: Improve 'invalid wait context' splat	2020-04-08 12:05:07 +02:00
power	PM / sleep: handle the compat case in snapshot_set_swap_area()	2020-04-06 21:42:36 +02:00
printk	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
rcu	Merge branch 'urgent-for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/urgent	2020-04-14 08:36:41 +02:00
sched	Merge branch 'work.sysctl' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-28 21:23:38 +02:00
time	Merge branch 'work.sysctl' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-28 21:23:38 +02:00
trace	Merge branch 'work.sysctl' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2020-04-28 21:23:38 +02:00
.gitignore
acct.c
async.c
audit_fsnotify.c
audit_tree.c
audit_watch.c	\n	2020-04-06 08:58:42 -07:00
audit.c	audit: check the length of userspace generated audit records	2020-04-20 17:10:58 -04:00
audit.h
auditfilter.c
auditsc.c
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c
crash_core.c
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c	proc: Put thread_pid in release_task not proc_flush_pid	2020-04-24 15:49:00 -05:00
extable.c	kernel/extable.c: use address-of operator on section symbols	2020-04-07 10:43:42 -07:00
fail_function.c
fork.c	clone3: add build-time CLONE_ARGS_SIZE_VER* validity checks	2020-04-15 09:56:32 +02:00
freezer.c
futex.c
gen_kheaders.sh
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c	kallsyms: unexport kallsyms_lookup_name() and kallsyms_on_each_symbol()	2020-04-07 10:43:44 -07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec_core.c
kexec_elf.c
kexec_file.c
kexec_internal.h
kexec.c
kheaders.c
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2020-04-10 15:36:22 -07:00
kprobes.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
ksysfs.c
kthread.c
latencytop.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
Makefile
module_signature.c
module_signing.c
module-internal.h
module.c	kernel/module: Hide vermagic header file from general use	2020-04-21 13:27:37 -07:00
notifier.c
nsproxy.c
padata.c
panic.c
params.c
pid_namespace.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
pid.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-04-10 12:59:56 -07:00
profile.c
ptrace.c
range.c
reboot.c
relay.c
resource.c
rseq.c
seccomp.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
signal.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-04-23 13:30:18 -07:00
smp.c
smpboot.c
smpboot.h
softirq.c
stackleak.c
stacktrace.c
stop_machine.c
sys_ni.c
sys.c
sysctl_binary.c
sysctl-test.c
sysctl.c	bpf: Sharing bpf runtime stats with BPF_ENABLE_STATS	2020-05-01 10:36:32 -07:00
task_work.c
taskstats.c
test_kprobes.c
torture.c
tracepoint.c
tsacct.c
ucount.c	ucount: Make sure ucounts in /proc/sys/user don't regress again	2020-04-07 21:51:27 +02:00
uid16.c
uid16.h
umh.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
up.c
user_namespace.c
user-return-notifier.c
user.c
utsname_sysctl.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
utsname.c
watchdog_hld.c
watchdog.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
workqueue_internal.h
workqueue.c	workqueue: Remove the warning in wq_worker_sleeping()	2020-04-08 11:35:20 +02:00