bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach
authorJiri Olsa <jolsa@kernel.org>
Mon, 11 Jan 2021 19:16:50 +0000 (20:16 +0100)
committerDaniel Borkmann <daniel@iogearbox.net>
Mon, 11 Jan 2021 23:17:34 +0000 (00:17 +0100)
commit5541075a348b6ca6ac668653f7d2c423ae8e00b6
tree42706ccb77a9bb603822a9ff9168c4199c38674d
parentf97844f9c518172f813b7ece18a9956b1f70c1bb
bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach

The bpf_tracing_prog_attach error path calls bpf_prog_put
on prog, which causes refcount underflow when it's called
from link_create function.

  link_create
    prog = bpf_prog_get              <-- get
    ...
    tracing_bpf_link_attach(prog..
      bpf_tracing_prog_attach(prog..
        out_put_prog:
          bpf_prog_put(prog);        <-- put

    if (ret < 0)
      bpf_prog_put(prog);            <-- put

Removing bpf_prog_put call from bpf_tracing_prog_attach
and making sure its callers call it instead.

Fixes: 4a1e7c0c63e0 ("bpf: Support attaching freplace programs to multiple attach points")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210111191650.1241578-1-jolsa@kernel.org
kernel/bpf/syscall.c