diff options
| author | Alexei Starovoitov <ast@fb.com> | 2019-05-09 19:33:53 -0700 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-04-19 00:51:27 +0300 |
| commit | 4b64d2b748de7c521a22e983f61e376389e1058f (patch) | |
| tree | 54b06420b29f37d45871de4e4aba6d1cf762904c /kernel/bpf/inode.c | |
| parent | 01be844fcf75364d429b1dd0ef657e48ba8ef3de (diff) | |
bpf: fix struct htab_elem layout
commit 9f691549f76d488a0c74397b3e51e943865ea01f upstream.
when htab_elem is removed from the bucket list the htab_elem.hash_node.next
field should not be overridden too early otherwise we have a tiny race window
between lookup and delete.
The bug was discovered by manual code analysis and reproducible
only with explicit udelay() in lookup_elem_raw().
Fixes: 6c9059817432 ("bpf: pre-allocate hash map elements")
Reported-by: Jonathan Perry <jonperry@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chenbo Feng <fengc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Chatur27 <jasonbright2709@gmail.com>
Diffstat (limited to 'kernel/bpf/inode.c')
0 files changed, 0 insertions, 0 deletions