bpf: decrease usercnt if bpf_map_new_fd() fails in bpf_map_get_fd_by_id()

snorez · borkmann · commit 781e62823cb8 · 2019-02-26T19:08:30.000+01:00
In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero() to increase the refcount, both map->refcnt and map->usercnt. Then, if bpf_map_new_fd() fails, should handle map->usercnt too. Fixes: bd5f5f4 ("bpf: Add BPF_MAP_GET_FD_BY_ID") Signed-off-by: Peng Sun <sironhide0null@gmail.com> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
@@ -1986,7 +1986,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
 
 	fd = bpf_map_new_fd(map, f_flags);
 	if (fd < 0)
-		bpf_map_put(map);
+		bpf_map_put_with_uref(map);
 
 	return fd;
 }

Original file line number	Diff line number	Diff line change
`@@ -1986,7 +1986,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)`
`1986`	`1986`
`1987`	`1987`	`fd = bpf_map_new_fd(map, f_flags);`
`1988`	`1988`	`if (fd < 0)`
`1989`		`- bpf_map_put(map);`
	`1989`	`+ bpf_map_put_with_uref(map);`
`1990`	`1990`
`1991`	`1991`	`return fd;`
`1992`	`1992`	`}`