Messages in this thread |  | | Date | Thu, 19 Dec 2019 18:25:04 -0500 | From | Sasha Levin <> | Subject | Re: [oss-drivers] [PATCH AUTOSEL 5.4 326/350] bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails |
| |
On Thu, Dec 12, 2019 at 05:25:13PM +0100, Daniel Borkmann wrote: >On Tue, Dec 10, 2019 at 01:28:34PM -0800, Jakub Kicinski wrote: >> On Tue, 10 Dec 2019 16:07:11 -0500, Sasha Levin wrote: >> > From: Andrii Nakryiko <andriin@fb.com> >> > >> > [ Upstream commit 1e0bd5a091e5d9e0f1d5b0e6329b87bb1792f784 ] >> > >> > 92117d8443bc ("bpf: fix refcnt overflow") turned refcounting of bpf_map into >> > potentially failing operation, when refcount reaches BPF_MAX_REFCNT limit >> > (32k). Due to using 32-bit counter, it's possible in practice to overflow >> > refcounter and make it wrap around to 0, causing erroneous map free, while >> > there are still references to it, causing use-after-free problems. >> >> I don't think this is a bug fix, the second sentence here is written >> in a quite confusing way, but there is no bug. >> >> Could you drop? I don't think it's worth the backporting pain since it >> changes bpf_map_inc(). > >Agree, this is not a bug fix and should not go to stable. (Also agree that >the changelog is super confusing here and should have been done differently >to avoid exactly where we are here. I think I pointed that out in the >original patch, but seems this slipped through the cracks :/)
Sure, dropped, thanks!
-- Thanks, Sasha
|  |