Jann Horn 7b6460337e bpf: fix double-fdput in replace_map_fd_with_map_ptr() ... [ Upstream commit 8358b02bf6 ] When bpf(BPF_PROG_LOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in __bpf_map_get() and in replace_map_fd_with_map_ptr()). If the file descriptor table of the current task is shared, this causes f_count to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free). This can be exploited to gain root privileges by an unprivileged user. This bug was introduced in commit 0246e64d9a ("bpf: handle pseudo BPF_LD_IMM64 insn"), but is only exploitable since commit 1be7f75d16 ("bpf: enable non-root eBPF programs") because previously, CAP_SYS_ADMIN was required to reach the vulnerable code. (posted publicly according to request by maintainer) Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>		2016-07-10 23:07:22 -04:00
..
Makefile	ebpf: remove kernel test stubs	2015-03-01 14:05:18 -05:00
arraymap.c	bpf, array: fix heap out-of-bounds access when updating elements	2015-12-14 21:24:32 -08:00
core.c	bpf: fix 64-bit divide	2015-04-27 23:11:49 -04:00
hashtab.c	ebpf: constify various function pointer structs	2015-03-01 14:05:18 -05:00
helpers.c	ebpf: add helper for obtaining current processor id	2015-03-15 21:57:25 -04:00
syscall.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-15 09:00:47 -07:00
verifier.c	bpf: fix double-fdput in replace_map_fd_with_map_ptr()	2016-07-10 23:07:22 -04:00