]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
flow_dissector: Drop BPF flow dissector prog ref on netns cleanup
authorJakub Sitnicki <jakub@cloudflare.com>
Thu, 21 May 2020 08:34:35 +0000 (10:34 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 27 May 2020 15:48:29 +0000 (17:48 +0200)
commit0b846ed9f5edf5afd0b2bdaaaf3be7c50933aeb8
treeb796ed54ba5480d6688e7070b4f611c841c1aede
parent13496defdcc80d2fc5c93e602c04ce2cc69c90f7
flow_dissector: Drop BPF flow dissector prog ref on netns cleanup

commit 5cf65922bb15279402e1e19b5ee8c51d618fa51f upstream.

When attaching a flow dissector program to a network namespace with
bpf(BPF_PROG_ATTACH, ...) we grab a reference to bpf_prog.

If netns gets destroyed while a flow dissector is still attached, and there
are no other references to the prog, we leak the reference and the program
remains loaded.

Leak can be reproduced by running flow dissector tests from selftests/bpf:

  # bpftool prog list
  # ./test_flow_dissector.sh
  ...
  selftests: test_flow_dissector [PASS]
  # bpftool prog list
  4: flow_dissector  name _dissect  tag e314084d332a5338  gpl
          loaded_at 2020-05-20T18:50:53+0200  uid 0
          xlated 552B  jited 355B  memlock 4096B  map_ids 3,4
          btf_id 4
  #

Fix it by detaching the flow dissector program when netns is going away.

Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20200521083435.560256-1-jakub@cloudflare.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/flow_dissector.c