bpf: Don't leak memory in bpf getsockopt when optlen == 0
authorStanislav Fomichev <sdf@google.com>
Tue, 12 Jan 2021 16:28:29 +0000 (08:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Jan 2021 15:03:58 +0000 (16:03 +0100)
commit3ed29995c281762df98cccf86afbddbfb6a918ef
tree5173cd67fdf53e649a18e3ca979d71ff67c66c91
parentfdcaa4af5e70e2d984c9620a09e9dade067f2620
bpf: Don't leak memory in bpf getsockopt when optlen == 0

commit 4be34f3d0731b38a1b24566b37fbb39500aaf3a2 upstream.

optlen == 0 indicates that the kernel should ignore BPF buffer
and use the original one from the user. We, however, forget
to free the temporary buffer that we've allocated for BPF.

Fixes: d8fe449a9c51 ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE")
Reported-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210112162829.775079-1-sdf@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/bpf/cgroup.c