10 Dec
2019
10 Dec
'19
9:28 p.m.
On Tue, 10 Dec 2019 16:07:11 -0500, Sasha Levin wrote:
From: Andrii Nakryiko andriin@fb.com
[ Upstream commit 1e0bd5a091e5d9e0f1d5b0e6329b87bb1792f784 ]
92117d8443bc ("bpf: fix refcnt overflow") turned refcounting of bpf_map into potentially failing operation, when refcount reaches BPF_MAX_REFCNT limit (32k). Due to using 32-bit counter, it's possible in practice to overflow refcounter and make it wrap around to 0, causing erroneous map free, while there are still references to it, causing use-after-free problems.
I don't think this is a bug fix, the second sentence here is written in a quite confusing way, but there is no bug.
Could you drop? I don't think it's worth the backporting pain since it changes bpf_map_inc().