Commit 4be34f3d authored by Stanislav Fomichev's avatar Stanislav Fomichev Committed by Daniel Borkmann
Browse files

bpf: Don't leak memory in bpf getsockopt when optlen == 0 



optlen == 0 indicates that the kernel should ignore BPF buffer
and use the original one from the user. We, however, forget
to free the temporary buffer that we've allocated for BPF.

Fixes: d8fe449a ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE")
Reported-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210112162829.775079-1-sdf@google.com
parent 2f94ac19

kernel/bpf/cgroup.c

+3 −2
Original line number Diff line number Diff line
@@ -1391,11 +1391,12 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level, 
		if (ctx.optlen != 0) {

			*optlen = ctx.optlen;

			*kernel_optval = ctx.optval;

			/* export and don't free sockopt buf */

			return 0;

		}

	}



out:

	if (ret)

	sockopt_free_buf(&ctx);

	return ret;

}