Commit 5541075a authored by Jiri Olsa's avatar Jiri Olsa Committed by Daniel Borkmann
Browse files

bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach 



The bpf_tracing_prog_attach error path calls bpf_prog_put
on prog, which causes refcount underflow when it's called
from link_create function.

  link_create
    prog = bpf_prog_get              <-- get
    ...
    tracing_bpf_link_attach(prog..
      bpf_tracing_prog_attach(prog..
        out_put_prog:
          bpf_prog_put(prog);        <-- put

    if (ret < 0)
      bpf_prog_put(prog);            <-- put

Removing bpf_prog_put call from bpf_tracing_prog_attach
and making sure its callers call it instead.

Fixes: 4a1e7c0c ("bpf: Support attaching freplace programs to multiple attach points")
Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210111191650.1241578-1-jolsa@kernel.org
parent f97844f9

kernel/bpf/syscall.c

+4 −2
Original line number Diff line number Diff line
@@ -2712,7 +2712,6 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog, 
out_put_prog:

	if (tgt_prog_fd && tgt_prog)

		bpf_prog_put(tgt_prog);

	bpf_prog_put(prog);

	return err;

}
@@ -2825,7 +2824,10 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr) 
			tp_name = prog->aux->attach_func_name;

			break;

		}

		return bpf_tracing_prog_attach(prog, 0, 0);

		err = bpf_tracing_prog_attach(prog, 0, 0);

		if (err >= 0)

			return err;

		goto out_put_prog;

	case BPF_PROG_TYPE_RAW_TRACEPOINT:

	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:

		if (strncpy_from_user(buf,