Patch "bpf: Preserve param->string when parsing mount options" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Preserve param->string when parsing mount options

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-preserve-param-string-when-parsing-mount-options.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e603c8a9dbc29843f4f0a05129be20195a689147
Author: Hou Tao <houtao1@xxxxxxxxxx>
Date:   Tue Oct 22 21:01:33 2024 +0800

    bpf: Preserve param->string when parsing mount options
    
    [ Upstream commit 1f97c03f43fadc407de5b5cb01c07755053e1c22 ]
    
    In bpf_parse_param(), keep the value of param->string intact so it can
    be freed later. Otherwise, the kmalloc area pointed to by param->string
    will be leaked as shown below:
    
    unreferenced object 0xffff888118c46d20 (size 8):
      comm "new_name", pid 12109, jiffies 4295580214
      hex dump (first 8 bytes):
        61 6e 79 00 38 c9 5c 7e                          any.8.\~
      backtrace (crc e1b7f876):
        [<00000000c6848ac7>] kmemleak_alloc+0x4b/0x80
        [<00000000de9f7d00>] __kmalloc_node_track_caller_noprof+0x36e/0x4a0
        [<000000003e29b886>] memdup_user+0x32/0xa0
        [<0000000007248326>] strndup_user+0x46/0x60
        [<0000000035b3dd29>] __x64_sys_fsconfig+0x368/0x3d0
        [<0000000018657927>] x64_sys_call+0xff/0x9f0
        [<00000000c0cabc95>] do_syscall_64+0x3b/0xc0
        [<000000002f331597>] entry_SYSCALL_64_after_hwframe+0x4b/0x53
    
    Fixes: 6c1752e0b6ca ("bpf: Support symbolic BPF FS delegation mount options")
    Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
    Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20241022130133.3798232-1-houtao@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index af5d2ffadd70b..00b8dc8ef7385 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -880,7 +880,7 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
 		const struct btf_type *enum_t;
 		const char *enum_pfx;
 		u64 *delegate_msk, msk = 0;
-		char *p;
+		char *p, *str;
 		int val;
 
 		/* ignore errors, fallback to hex */
@@ -911,7 +911,8 @@ static int bpf_parse_param(struct fs_context *fc, struct fs_parameter *param)
 			return -EINVAL;
 		}
 
-		while ((p = strsep(&param->string, ":"))) {
+		str = param->string;
+		while ((p = strsep(&str, ":"))) {
 			if (strcmp(p, "any") == 0) {
 				msk |= ~0ULL;
 			} else if (find_btf_enum_const(info.btf, enum_t, enum_pfx, p, &val)) {