From: Daniel Borkmann daniel@iogearbox.net
commit 20b2b24f91f70e7d3f0918c077546cb21bd73a87 upstream.
In map_create(), we first find and create the map, then once that suceeded, we charge it to the user's RLIMIT_MEMLOCK, and then fetch a new anon fd through anon_inode_getfd(). The problem is, once the latter fails f.e. due to RLIMIT_NOFILE limit, then we only destruct the map via map->ops->map_free(), but without uncharging the previously locked memory first. That means that the user_struct allocation is leaked as well as the accounted RLIMIT_MEMLOCK memory not released. Make the label names in the fix consistent with bpf_prog_load().
Fixes: aaac3ba95e4c ("bpf: charge user for creation of BPF maps and programs") Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: Alexei Starovoitov ast@kernel.org Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- kernel/bpf/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -152,7 +152,7 @@ static int map_create(union bpf_attr *at
err = bpf_map_charge_memlock(map); if (err) - goto free_map; + goto free_map_nouncharge;
err = bpf_map_new_fd(map); if (err < 0) @@ -162,6 +162,8 @@ static int map_create(union bpf_attr *at return err;
free_map: + bpf_map_uncharge_memlock(map); +free_map_nouncharge: map->ops->map_free(map); return err; }