diff options
| author | Song Liu <song@kernel.org> | 2022-03-02 09:51:26 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2022-03-02 13:24:37 -0800 |
| commit | 676b2daabaf9a993db0e02a5ce79b984aaa0388b (patch) | |
| tree | 81b456d3fc63e54aaefe5a49187a8053474abfc6 /arch | |
| parent | eed1fcee556fd8569afe94178b0c2784a5a6b717 (diff) | |
| download | linux-676b2daabaf9a993db0e02a5ce79b984aaa0388b.tar.gz | |
bpf, x86: Set header->size properly before freeing it
On do_jit failure path, the header is freed by bpf_jit_binary_pack_free.
While bpf_jit_binary_pack_free doesn't require proper ro_header->size,
bpf_prog_pack_free still uses it. Set header->size in bpf_int_jit_compile
before calling bpf_jit_binary_pack_free.
Fixes: 1022a5498f6f ("bpf, x86_64: Use bpf_jit_binary_pack_alloc")
Fixes: 33c9805860e5 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]")
Reported-by: Kui-Feng Lee <kuifeng@fb.com>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20220302175126.247459-3-song@kernel.org
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/x86/net/bpf_jit_comp.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index c7db0fe4de2f..e6ff8f4f9ea4 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2330,8 +2330,11 @@ skip_init_addrs: if (proglen <= 0) { out_image: image = NULL; - if (header) + if (header) { + bpf_arch_text_copy(&header->size, &rw_header->size, + sizeof(rw_header->size)); bpf_jit_binary_pack_free(header, rw_header); + } prog = orig_prog; goto out_addrs; } |