Re: [PATCH v2 bpf-next] bpf: fix use-after-free of bpf_link when priming half-fails

2020-05-01 Thread Alexei Starovoitov
On Fri, May 1, 2020 at 1:00 PM Martin KaFai Lau wrote: > > On Fri, May 01, 2020 at 11:56:22AM -0700, Andrii Nakryiko wrote: > > If bpf_link_prime() succeeds to allocate new anon file, but then fails to > > allocate ID for it, link priming is considered to be failed and user is > > supposed ot be a

Re: [PATCH v2 bpf-next] bpf: fix use-after-free of bpf_link when priming half-fails

2020-05-01 Thread Martin KaFai Lau
On Fri, May 01, 2020 at 11:56:22AM -0700, Andrii Nakryiko wrote: > If bpf_link_prime() succeeds to allocate new anon file, but then fails to > allocate ID for it, link priming is considered to be failed and user is > supposed ot be able to directly kfree() bpf_link, because it was never exposed > t

[PATCH v2 bpf-next] bpf: fix use-after-free of bpf_link when priming half-fails

2020-05-01 Thread Andrii Nakryiko
If bpf_link_prime() succeeds to allocate new anon file, but then fails to allocate ID for it, link priming is considered to be failed and user is supposed ot be able to directly kfree() bpf_link, because it was never exposed to user-space. But at that point file already keeps a pointer to bpf_link