Unverified Commit 5d590c4c authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12301 bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Pu Lehui <pulehui@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VN7TECD67V4H73E4INXJKVYJZ4OXVZQ6/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYPJ9 
 
Link:https://gitee.com/openeuler/kernel/pulls/12301

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 6163d2da 56e36f56

kernel/trace/bpf_trace.c

+6 −3
Original line number Diff line number Diff line
@@ -3283,17 +3283,20 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr 
					     uprobes[i].ref_ctr_offset,

					     &uprobes[i].consumer);

		if (err) {

			bpf_uprobe_unregister(&path, uprobes, i);

			goto error_free;

			link->cnt = i;

			goto error_unregister;

		}

	}



	err = bpf_link_prime(&link->link, &link_primer);

	if (err)

		goto error_free;

		goto error_unregister;



	return bpf_link_settle(&link_primer);



error_unregister:

	bpf_uprobe_unregister(&path, uprobes, link->cnt);



error_free:

	kvfree(uprobes);

	kfree(link);