HID: bpf: remove double fdget()
authorBenjamin Tissoires <bentiss@kernel.org>
Wed, 24 Jan 2024 11:26:57 +0000 (12:26 +0100)
committerBenjamin Tissoires <bentiss@kernel.org>
Wed, 31 Jan 2024 09:27:00 +0000 (10:27 +0100)
commit7cdd2108903a4e369eb37579830afc12a6877ec2
tree53d7b58e90273e85e237500a2b887a18497d6c5d
parent00aab7dcb2267f2aef59447602f34501efe1a07f
HID: bpf: remove double fdget()

When the kfunc hid_bpf_attach_prog() is called, we called twice fdget():
one for fetching the type of the bpf program, and one for actually
attaching the program to the device.

The problem is that between those two calls, we have no guarantees that
the prog_fd is still the same file descriptor for the given program.

Solve this by calling bpf_prog_get() earlier, and use this to fetch the
program type.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/bpf/CAO-hwJJ8vh8JD3-P43L-_CLNmPx0hWj44aom0O838vfP4=_1CA@mail.gmail.com/T/#t
Cc: <stable@vger.kernel.org>
Fixes: f5c27da4e3c8 ("HID: initial BPF implementation")
Link: https://lore.kernel.org/r/20240124-b4-hid-bpf-fixes-v2-1-052520b1e5e6@kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
drivers/hid/bpf/hid_bpf_dispatch.c
drivers/hid/bpf/hid_bpf_dispatch.h
drivers/hid/bpf/hid_bpf_jmp_table.c