On Tue, Dec 13, 2022 at 9:58 AM Milan Landaverde <milan@xxxxxxxxxxxx> wrote: > > In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, > but in our validation to make sure the prog is meant to be attached to > BPF_LSM_CGROUP, we return too early if the check fails. This results in > lack of decrementing prog's refcnt (through bpf_prog_put) > leaving the LSM program alive past the point of the expected lifecycle. > This fix allows for the decrement to take place. > > [0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@xxxxxxxxxx/ > > Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor") > Signed-off-by: Milan Landaverde <milan@xxxxxxxxxxxx> Makes sense, thank you! Reviewed-by: Stanislav Fomichev <sdf@xxxxxxxxxx> > --- > kernel/bpf/syscall.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c > index 35972afb6850..64131f88c553 100644 > --- a/kernel/bpf/syscall.c > +++ b/kernel/bpf/syscall.c > @@ -3518,9 +3518,9 @@ static int bpf_prog_attach(const union bpf_attr *attr) > case BPF_PROG_TYPE_LSM: > if (ptype == BPF_PROG_TYPE_LSM && > prog->expected_attach_type != BPF_LSM_CGROUP) > - return -EINVAL; > - > - ret = cgroup_bpf_prog_attach(attr, ptype, prog); > + ret = -EINVAL; > + else > + ret = cgroup_bpf_prog_attach(attr, ptype, prog); > break; > default: > ret = -EINVAL; > -- > 2.34.1 >
