]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
bpf: prevent leak of lsm program after failed attach
authorMilan Landaverde <milan@mdaverde.com>
Tue, 13 Dec 2022 17:57:14 +0000 (12:57 -0500)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 14 Dec 2022 17:35:41 +0000 (18:35 +0100)
commite89f3edffb860a0f54a9ed16deadb7a4a1fa3862
treed953d34b8c4be2f7ce66f7d34eb07f0727ac392a
parenta8dfde09c90109e3a98af54847e91bde7dc2d5c2
bpf: prevent leak of lsm program after failed attach

In [0], we added the ability to bpf_prog_attach LSM programs to cgroups,
but in our validation to make sure the prog is meant to be attached to
BPF_LSM_CGROUP, we return too early if the check fails. This results in
lack of decrementing prog's refcnt (through bpf_prog_put)
leaving the LSM program alive past the point of the expected lifecycle.
This fix allows for the decrement to take place.

[0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/

Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
Signed-off-by: Milan Landaverde <milan@mdaverde.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/r/20221213175714.31963-1-milan@mdaverde.com
kernel/bpf/syscall.c