Cong Wang 2884dc7d08 bpf: Fix a potential use-after-free in bpf_link_free() ...

After commit 1a80dbcb2dba, bpf_link can be freed by
link->ops->dealloc_deferred, but the code still tests and uses
link->ops->dealloc afterward, which leads to a use-after-free as
reported by syzbot. Actually, one of them should be sufficient, so
just call one of them instead of both. Also add a WARN_ON() in case
of any problematic implementation.

Fixes: 1a80dbcb2dba ("bpf: support deferring bpf_link dealloc to after RCU grace period")
Reported-by: syzbot+1989ee16d94720836244@syzkaller.appspotmail.com
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/bpf/20240602182703.207276-1-xiyou.wangcong@gmail.com

2024-06-03 18:16:19 +02:00

..

preload

bpf: make preloaded map iterators to display map elements count

2023-07-06 12:42:25 -07:00

arena.c

The usual shower of singleton fixes and minor series all over MM,

2024-05-19 09:21:03 -07:00

arraymap.c

bpf: Do not walk twice the map on free

2024-04-30 16:28:33 +02:00

bloom_filter.c

bpf: Check bloom filter map value size

2024-03-27 09:56:17 -07:00

bpf_cgrp_storage.c

bpf: Enable bpf_cgrp_storage for cgroup1 non-attach case

2023-12-08 17:08:18 -08:00

bpf_inode_storage.c

Networking changes for 6.4.

2023-04-26 16:07:23 -07:00

bpf_iter.c

bpf: move sleepable flag from bpf_prog_aux to bpf_prog

2024-03-11 16:41:25 -07:00

bpf_local_storage.c

bpf: Fix typos in comments

2024-04-22 17:48:08 +02:00

bpf_lru_list.c

bpf: Address KCSAN report on bpf_lru_list

2023-05-12 12:01:03 -07:00

bpf_lru_list.h

bpf: lru: Remove unused declaration bpf_lru_promote()

2023-08-08 17:21:42 -07:00

bpf_lsm.c

bpf: Minor clean-up to sleepable_lsm_hooks BTF set

2024-02-01 18:37:45 +01:00

bpf_struct_ops.c

bpf: Check return from set_memory_rox()

2024-03-18 14:18:47 -07:00

bpf_task_storage.c

bpf: Teach verifier that certain helpers accept NULL pointer.

2023-04-04 16:57:16 -07:00

btf.c

bpf: Add support for kprobe session context

2024-04-30 09:45:53 -07:00

cgroup_iter.c

bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg

2023-11-07 15:24:25 -08:00

cgroup.c

bpf: Allow helper bpf_get_[ns_]current_pid_tgid() for all prog types

2024-03-19 14:24:07 -07:00

core.c

Modules changes for v6.10-rc1

2024-05-15 14:05:08 -07:00

cpumap.c

bpf: report RCU QS in cpumap kthread

2024-03-20 21:05:43 -07:00

cpumask.c

bpf: Allow invoking kfuncs from BPF_PROG_TYPE_SYSCALL progs

2024-04-05 10:56:09 -07:00

crypto.c

bpf: make common crypto API for TC/XDP programs

2024-04-24 16:01:10 -07:00

devmap.c

bpf, devmap: Remove unnecessary if check in for loop

2024-06-03 17:09:23 +02:00

disasm.c

bpf: add special internal-only MOV instruction to resolve per-CPU addrs

2024-04-03 10:29:55 -07:00

disasm.h

bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause

2021-09-02 14:49:23 +02:00

dispatcher.c

bpf: Use arch_bpf_trampoline_size

2023-12-06 17:17:20 -08:00

hashtab.c

bpf: Do not walk twice the hash map on free

2024-04-30 16:28:46 +02:00

helpers.c

bpf: make common crypto API for TC/XDP programs

2024-04-24 16:01:10 -07:00

inode.c

bpf: Support symbolic BPF FS delegation mount options

2024-01-24 16:21:02 -08:00

Kconfig

bpf: remove CONFIG_BPF_JIT dependency on CONFIG_MODULES of

2024-05-14 00:36:29 -07:00

link_iter.c

bpf: Add bpf_link iterator

2022-05-10 11:20:45 -07:00

local_storage.c

cgroup changes for v6.4-rc1

2023-04-29 10:05:22 -07:00

log.c

bpf: Replace deprecated strncpy with strscpy

2024-04-03 16:57:41 +02:00

lpm_trie.c

bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.

2024-03-29 11:10:41 -07:00

Makefile

bpf: crypto: fix build when CONFIG_CRYPTO=m

2024-05-01 13:32:26 -07:00

map_in_map.c

bpf: save extended inner map info for percpu array maps as well

2024-05-15 09:34:54 -07:00

map_in_map.h

bpf: Add map and need_defer parameters to .map_fd_put_ptr()

2023-12-04 17:50:26 -08:00

map_iter.c

bpf: treewide: Annotate BPF kfuncs in BTF

2024-01-31 20:40:56 -08:00

memalloc.c

mm: memcg: add NULL check to obj_cgroup_put()

2024-04-25 20:55:43 -07:00

mmap_unlock_work.h

bpf: Introduce helper bpf_find_vma

2021-11-07 11:54:51 -08:00

mprog.c

bpf: Handle bpf_mprog_query with NULL entry

2023-10-06 17:11:20 -07:00

net_namespace.c

net: Add includes masked by netdevice.h including uapi/bpf.h

2021-12-29 20:03:05 -08:00

offload.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2023-09-21 21:49:45 +02:00

percpu_freelist.c

bpf: Initialize same number of free nodes for each pcpu_freelist

2022-11-11 12:05:14 -08:00

percpu_freelist.h

bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI

2020-10-06 00:04:11 +02:00

prog_iter.c

bpf: Refactor bpf_iter_reg to have separate seq_info member

2020-07-25 20:16:32 -07:00

queue_stack_maps.c

bpf: Avoid deadlock when using queue and stack maps from NMI

2023-09-11 19:04:49 -07:00

reuseport_array.c

bpf: Centralize permissions checks for all BPF map types

2023-06-19 14:04:04 +02:00

ringbuf.c

bpf: Fold smp_mb__before_atomic() into atomic_set_release()

2023-10-24 14:26:07 +02:00

stackmap.c

bpf: Fix stackmap overflow check on 32-bit arches

2024-03-07 20:06:25 -08:00

syscall.c

bpf: Fix a potential use-after-free in bpf_link_free()

2024-06-03 18:16:19 +02:00

sysfs_btf.c

btf: Avoid weak external references

2024-04-16 16:35:13 +02:00

task_iter.c

bpf: Fix an issue due to uninitialized bpf_iter_task

2024-02-19 12:28:15 +01:00

tcx.c

bpf, tcx: Get rid of tcx_link_const

2023-10-23 15:01:53 -07:00

tnum.c

bpf: simplify tnum output if a fully known constant

2023-12-02 11:36:51 -08:00

token.c

bpf,token: Use BIT_ULL() to convert the bit mask

2024-01-29 20:04:55 -08:00

trampoline.c

Networking changes for 6.10.

2024-05-14 19:42:24 -07:00

verifier.c

bpf: Fix bpf_session_cookie BTF_ID in special_kfunc_set list

2024-05-31 14:54:48 -07:00