Daniel Borkmann 483bed2b0d bpf: fix htab map destruction when extra reserve is in use ... Commit a6ed3ea65d ("bpf: restore behavior of bpf_map_update_elem") added an extra per-cpu reserve to the hash table map to restore old behaviour from pre prealloc times. When non-prealloc is in use for a map, then problem is that once a hash table extra element has been linked into the hash-table, and the hash table is destroyed due to refcount dropping to zero, then htab_map_free() -> delete_all_elements() will walk the whole hash table and drop all elements via htab_elem_free(). The problem is that the element from the extra reserve is first fed to the wrong backend allocator and eventually freed twice. Fixes: a6ed3ea65d ("bpf: restore behavior of bpf_map_update_elem") Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-11-07 13:20:52 -05:00
..
arraymap.c	bpf: Add bpf_current_task_under_cgroup helper	2016-08-12 21:49:41 -07:00
core.c	bpf: clean up put_cpu_var usage	2016-09-27 22:09:17 -04:00
hashtab.c	bpf: fix htab map destruction when extra reserve is in use	2016-11-07 13:20:52 -05:00
helpers.c	bpf: direct packet write and access for helpers for clsact progs	2016-09-20 23:32:11 -04:00
inode.c	fs: Replace CURRENT_TIME with current_time() for inode timestamps	2016-09-27 21:06:21 -04:00
Makefile	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
percpu_freelist.c	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
percpu_freelist.h	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
stackmap.c	bpf: add BPF_CALL_x macros for declaring helpers	2016-09-09 19:36:04 -07:00
syscall.c	bpf: add bpf_prog_add api for bulk prog refcnt	2016-07-19 21:46:31 -07:00
verifier.c	bpf: allow access into map value arrays	2016-09-29 01:35:35 -04:00