From: Stanislav Fomichev <s...@google.com> commit 4be34f3d0731b38a1b24566b37fbb39500aaf3a2 upstream.
optlen == 0 indicates that the kernel should ignore BPF buffer and use the original one from the user. We, however, forget to free the temporary buffer that we've allocated for BPF. Fixes: d8fe449a9c51 ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE") Reported-by: Martin KaFai Lau <ka...@fb.com> Signed-off-by: Stanislav Fomichev <s...@google.com> Signed-off-by: Daniel Borkmann <dan...@iogearbox.net> Acked-by: Martin KaFai Lau <ka...@fb.com> Link: https://lore.kernel.org/bpf/20210112162829.775079-1-...@google.com Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org> --- kernel/bpf/cgroup.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1057,12 +1057,13 @@ int __cgroup_bpf_run_filter_setsockopt(s if (ctx.optlen != 0) { *optlen = ctx.optlen; *kernel_optval = ctx.optval; + /* export and don't free sockopt buf */ + return 0; } } out: - if (ret) - sockopt_free_buf(&ctx); + sockopt_free_buf(&ctx); return ret; } EXPORT_SYMBOL(__cgroup_bpf_run_filter_setsockopt);