summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorSasha Levin <sasha.levin@oracle.com>2014-09-13 00:06:30 -0400
committerDavid S. Miller <davem@davemloft.net>2014-09-13 17:37:49 -0400
commitc0d1379a19c3dde3c32be50164997d246241c1e4 (patch)
treebab2f0bb3c42e17d571f8fcc20bffa5ebd89e2ab /net/core
parent3fc8867740b4a0bf56f372c6f5ddd14970962fb1 (diff)
downloadblackbird-op-linux-c0d1379a19c3dde3c32be50164997d246241c1e4.tar.gz
blackbird-op-linux-c0d1379a19c3dde3c32be50164997d246241c1e4.zip
net: bpf: correctly handle errors in sk_attach_filter()
Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog to be vmalloc()ed but never handled some of the errors paths of the old code. On error within sk_attach_filter (which userspace can easily trigger), we'd kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct. Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Acked-by: Daniel Borkmann <dborkman@redhat.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/filter.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index 601f28de7311..fcd3f6742a6a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1047,7 +1047,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
return -ENOMEM;
if (copy_from_user(prog->insns, fprog->filter, fsize)) {
- kfree(prog);
+ __bpf_prog_free(prog);
return -EFAULT;
}
@@ -1055,7 +1055,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
err = bpf_prog_store_orig_filter(prog, fprog);
if (err) {
- kfree(prog);
+ __bpf_prog_free(prog);
return -ENOMEM;
}
OpenPOWER on IntegriCloud