iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: Pin the start cgroup in cgroup_iter_seq_init()

Browse Source 
bpf_iter_attach_cgroup() has already acquired an extra reference for the
start cgroup, but the reference may be released if the iterator link fd
is closed after the creation of iterator fd, and it may lead to
user-after-free problem when reading the iterator fd.

An alternative fix is pinning iterator link when opening iterator,
but it will make iterator link being still visible after the close of
iterator link fd and the behavior is different with other link types, so
just fixing it by acquiring another reference for the start cgroup.

Fixes: d4ccaf58a8 ("bpf: Introduce cgroup iter")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20221121073440.1828292-2-houtao@huaweicloud.com
This commit is contained in:
Hou Tao 2022-11-21 15:34:38 +08:00 committed by Daniel Borkmann
parent ceb35b666d
commit 1a5160d4d8
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
kernel/bpf/cgroup_iter.c
View File

@ -164,16 +164,30 @@ static int cgroup_iter_seq_init(void *priv, struct bpf_iter_aux_info *aux)
struct cgroup_iter_priv *p = (struct cgroup_iter_priv *)priv; struct cgroup_iter_priv *p = (struct cgroup_iter_priv *)priv;
struct cgroup *cgrp = aux->cgroup.start; struct cgroup *cgrp = aux->cgroup.start;
/* bpf_iter_attach_cgroup() has already acquired an extra reference
* for the start cgroup, but the reference may be released after
* cgroup_iter_seq_init(), so acquire another reference for the
* start cgroup.
*/
p->start_css = &cgrp->self; p->start_css = &cgrp->self;
css_get(p->start_css);
p->terminate = false; p->terminate = false;
p->visited_all = false; p->visited_all = false;
p->order = aux->cgroup.order; p->order = aux->cgroup.order;
return 0; return 0;
} }
static void cgroup_iter_seq_fini(void *priv)
{
struct cgroup_iter_priv *p = (struct cgroup_iter_priv *)priv;
css_put(p->start_css);
}
static const struct bpf_iter_seq_info cgroup_iter_seq_info = { static const struct bpf_iter_seq_info cgroup_iter_seq_info = {
.seq_ops = &cgroup_iter_seq_ops, .seq_ops = &cgroup_iter_seq_ops,
.init_seq_private = cgroup_iter_seq_init, .init_seq_private = cgroup_iter_seq_init,
.fini_seq_private = cgroup_iter_seq_fini,
.seq_priv_size = sizeof(struct cgroup_iter_priv), .seq_priv_size = sizeof(struct cgroup_iter_priv),
}; };