Subject: Re: [PATCH] net: bpf: correctly handle errors in sk_attach_filter()

From: Hannes Frederic Sowa <[email-masked]>
Date: Sat, 13 Sep 2014 11:24:53 +0200

On Sa, 2014-09-13 at 00:06 -0400, Sasha Levin wrote:
> Commit "net: bpf: make eBPF interpreter images read-only" has changed bpf_prog
> to be vmalloc()ed but never handled some of the errors paths of the old code.
> 
> On error within sk_attach_filter (which userspace can easily trigger), we'd
> kfree() the vmalloc()ed memory, and leak the internal bpf_work_struct.
> 
> Signed-off-by: Sasha Levin <[email-masked]>

Yeah, thanks, we missed that somehow.

Acked-by: Hannes Frederic Sowa <[email-masked]>

Bye,
Hannes