On Mon, Jan 11, 2021 at 11:18 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
>
> The bpf_tracing_prog_attach error path calls bpf_prog_put
> on prog, which causes refcount underflow when it's called
> from link_create function.
>
> link_create
> prog = bpf_prog_get <-- get
> ...
> tracing_bpf_link_attach(prog..
> bpf_tracing_prog_attach(prog..
> out_put_prog:
> bpf_prog_put(prog); <-- put
>
> if (ret < 0)
> bpf_prog_put(prog); <-- put
>
> Removing bpf_prog_put call from bpf_tracing_prog_attach
> and making sure its callers call it instead.
>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
I also double-checked all other attach functions called from
link_create, they all seem to be fine and don't put prog on failure,
so this should be the only needed fix. Also, missing:
Fixes: 4a1e7c0c63e0 ("bpf: Support attaching freplace programs to
multiple attach points")
Acked-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
> kernel/bpf/syscall.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index c3bb03c8371f..e5999d86c76e 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -2712,7 +2712,6 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,
> out_put_prog:
> if (tgt_prog_fd && tgt_prog)
> bpf_prog_put(tgt_prog);
> - bpf_prog_put(prog);
> return err;
> }
>
> @@ -2825,7 +2824,10 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr)
> tp_name = prog->aux->attach_func_name;
> break;
> }
> - return bpf_tracing_prog_attach(prog, 0, 0);
> + err = bpf_tracing_prog_attach(prog, 0, 0);
> + if (err >= 0)
> + return err;
> + goto out_put_prog;
> case BPF_PROG_TYPE_RAW_TRACEPOINT:
> case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
> if (strncpy_from_user(buf,
> --
> 2.26.2
>
