2 files changed, 23 insertions, 16 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 5d141f16f6fa..272071e9112f 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1707,20 +1707,26 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
         if (err)
                 goto free_used_maps;
 
-        err = bpf_prog_new_fd(prog);
-        if (err < 0) {
-                /* failed to allocate fd.
-                 * bpf_prog_put() is needed because the above
-                 * bpf_prog_alloc_id() has published the prog
-                 * to the userspace and the userspace may
-                 * have refcnt-ed it through BPF_PROG_GET_FD_BY_ID.
-                 */
-                bpf_prog_put(prog);
-                return err;
-        }
-
+        /* Upon success of bpf_prog_alloc_id(), the BPF prog is
+         * effectively publicly exposed. However, retrieving via
+         * bpf_prog_get_fd_by_id() will take another reference,
+         * therefore it cannot be gone underneath us.
+         *
+         * Only for the time /after/ successful bpf_prog_new_fd()
+         * and before returning to userspace, we might just hold
+         * one reference and any parallel close on that fd could
+         * rip everything out. Hence, below notifications must
+         * happen before bpf_prog_new_fd().
+         *
+         * Also, any failure handling from this point onwards must
+         * be using bpf_prog_put() given the program is exposed.
+         */
         bpf_prog_kallsyms_add(prog);
         perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
+
+        err = bpf_prog_new_fd(prog);
+        if (err < 0)
+                bpf_prog_put(prog);
         return err;
 
 free_used_maps:
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 10c0ff93f52b..16d66bd7af09 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -985,9 +985,6 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
         reg->smax_value = S64_MAX;
         reg->umin_value = 0;
         reg->umax_value = U64_MAX;
-
-        /* constant backtracking is enabled for root only for now */
-        reg->precise = capable(CAP_SYS_ADMIN) ? false : true;
 }
 
 /* Mark a register as having a completely unknown (scalar) value. */
@@ -1014,7 +1011,11 @@ static void mark_reg_unknown(struct bpf_verifier_env *env,
                         __mark_reg_not_init(regs + regno);
                 return;
         }
-        __mark_reg_unknown(regs + regno);
+        regs += regno;
+        __mark_reg_unknown(regs);
+        /* constant backtracking is enabled for root without bpf2bpf calls */
+        regs->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ?
+                        true : false;
 }
 
 static void __mark_reg_not_init(struct bpf_reg_state *reg)