Alexei Starovoitov aad9db666c bpf: fix struct htab_elem layout ...

commit 9f691549f7 upstream.

when htab_elem is removed from the bucket list the htab_elem.hash_node.next
field should not be overridden too early otherwise we have a tiny race window
between lookup and delete.
The bug was discovered by manual code analysis and reproducible
only with explicit udelay() in lookup_elem_raw().

Fixes: 6c90598174 ("bpf: pre-allocate hash map elements")
Reported-by: Jonathan Perry <jonperry@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chenbo Feng <fengc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2019-05-16 19:43:40 +02:00

..

arraymap.c

bpf: map_get_next_key to return first key on NULL

2018-05-09 09:50:19 +02:00

core.c

bpf: fix divides by zero

2018-01-31 12:55:57 +01:00

hashtab.c

bpf: fix struct htab_elem layout

2019-05-16 19:43:40 +02:00

helpers.c

bpf: direct packet write and access for helpers for clsact progs

2016-09-20 23:32:11 -04:00

inode.c

fs: Replace CURRENT_TIME with current_time() for inode timestamps

2016-09-27 21:06:21 -04:00

Makefile

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

percpu_freelist.c

bpf: fix lockdep splat

2017-12-14 09:28:23 +01:00

percpu_freelist.h

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

stackmap.c

bpf: fix wrong exposure of map_flags into fdinfo for lpm

2018-03-11 16:21:34 +01:00

syscall.c

bpf: map_get_next_key to return first key on NULL

2018-05-09 09:50:19 +02:00

verifier.c

bpf: check pending signals while verifying programs

2018-12-21 14:11:38 +01:00