linux/kernel/bpf
John Fastabend 3d9e952697 bpf: sockmap, fix leaking maps with attached but not detached progs
When a program is attached to a map we increment the program refcnt
to ensure that the program is not removed while it is potentially
being referenced from sockmap side. However, if this same program
also references the map (this is a reasonably common pattern in
my programs) then the verifier will also increment the maps refcnt
from the verifier. This is to ensure the map doesn't get garbage
collected while the program has a reference to it.

So we are left in a state where the map holds the refcnt on the
program stopping it from being removed and releasing the map refcnt.
And vice versa the program holds a refcnt on the map stopping it
from releasing the refcnt on the prog.

All this is fine as long as users detach the program while the
map fd is still around. But, if the user omits this detach command
we are left with a dangling map we can no longer release.

To resolve this when the map fd is released decrement the program
references and remove any reference from the map to the program.
This fixes the issue with possibly dangling map and creates a
user side API constraint. That is, the map fd must be held open
for programs to be attached to a map.

Fixes: 174a79ff95 ("bpf: sockmap with sk redirect support")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2018-02-06 11:39:32 +01:00
..
Makefile
arraymap.c bpf: arraymap: use bpf_map_init_from_attr() 2018-01-18 22:54:25 +01:00
bpf_lru_list.c
bpf_lru_list.h
cgroup.c
core.c bpf: fix bpf_prog_array_copy_to_user() issues 2018-02-03 01:49:21 +01:00
cpumap.c bpf: cpumap: make some functions static 2018-01-17 00:12:58 +01:00
devmap.c bpf: add helper for copying attrs to struct bpf_map 2018-01-14 23:36:29 +01:00
disasm.c
disasm.h bpf: annotate bpf_insn_print_t with __printf 2018-01-17 01:15:05 +01:00
hashtab.c bpf: add helper for copying attrs to struct bpf_map 2018-01-14 23:36:29 +01:00
helpers.c
inode.c Merge branch 'work.mqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-01-30 18:32:21 -08:00
lpm_trie.c bpf: fix kernel page fault in lpm map trie_get_next_key 2018-01-26 17:06:22 -08:00
map_in_map.c
map_in_map.h
offload.c bpf: offload: report device information about offloaded maps 2018-01-18 22:54:25 +01:00
percpu_freelist.c
percpu_freelist.h
sockmap.c bpf: sockmap, fix leaking maps with attached but not detached progs 2018-02-06 11:39:32 +01:00
stackmap.c bpf: add helper for copying attrs to struct bpf_map 2018-01-14 23:36:29 +01:00
syscall.c bpf: Use the IS_FD_ARRAY() macro in map_update_elem() 2018-01-25 18:05:24 -08:00
tnum.c
verifier.c bpf: fix subprog verifier bypass by div/mod by 0 exception 2018-01-26 16:42:05 -08:00