]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bpf: Fix resetting logic for unreferenced kptrs
authorJules Irenge <jbi.octave@gmail.com>
Wed, 7 Sep 2022 15:24:20 +0000 (16:24 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 12 Oct 2022 07:51:26 +0000 (09:51 +0200)
commit6954cee8826819340594ef614341e4d634af3d4a
tree7f576204858ba6d1d8c5092d280fa0b2e7a44c0c
parent292b46c49675fcff39547b643d48d0fec27cdbb9
bpf: Fix resetting logic for unreferenced kptrs

commit 9fad7fe5b29803584c7f17a2abe6c2936fec6828 upstream.

Sparse reported a warning at bpf_map_free_kptrs()
"warning: Using plain integer as NULL pointer"
During the process of fixing this warning, it was discovered that the current
code erroneously writes to the pointer variable instead of deferencing and
writing to the actual kptr. Hence, Sparse tool accidentally helped to uncover
this problem. Fix this by doing WRITE_ONCE(*p, 0) instead of WRITE_ONCE(p, 0).

Note that the effect of this bug is that unreferenced kptrs will not be cleared
during check_and_free_fields. It is not a problem if the clearing is not done
during map_free stage, as there is nothing to free for them.

Fixes: 14a324f6a67e ("bpf: Wire up freeing of referenced kptr")
Signed-off-by: Jules Irenge <jbi.octave@gmail.com>
Link: https://lore.kernel.org/r/Yxi3pJaK6UDjVJSy@playground
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/bpf/syscall.c