bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
authorHou Tao <houtao1@huawei.com>
Wed, 10 Aug 2022 08:05:33 +0000 (16:05 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Aug 2022 09:40:03 +0000 (11:40 +0200)
commit03ca12e583f15d3881aab6275d240cb77238d1ee
treed3fd9e9b7ed38e83ee8d7bc79ead682c012a4f4e
parente51b568ea2c82254f3d3b4d481e6627f3c20c618
bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator

commit f0d2b2716d71778d0b0c8eaa433c073287d69d93 upstream.

sock_map_iter_attach_target() acquires a map uref, and the uref may be
released before or in the middle of iterating map elements. For example,
the uref could be released in sock_map_iter_detach_target() as part of
bpf_link_release(), or could be released in bpf_map_put_with_uref() as
part of bpf_map_release().

Fixing it by acquiring an extra map uref in .init_seq_private and
releasing it in .fini_seq_private.

Fixes: 0365351524d7 ("net: Allow iterating sockmap and sockhash")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20220810080538.1845898-5-houtao@huaweicloud.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/core/sock_map.c