[roll] Roll fuchsia [starnix][ebpf] Fix UAF in bpf_sk_storage_get Register the ref-counted MapValueRef returned by map.lookup() in the program's run context to ensure its lifetime extends to the end of the program execution. Previously, the temporary MapValueRef was dropped at the end of the helper, decrementing the ref-count prematurely. If the entry was deleted concurrently, it could be freed while the eBPF program still held the raw pointer. Added a regression unit test to verify that deleted socket storage entries are not prematurely reused while the context is alive. Original-Original-Fixed: b/518042596 Test: starnix_ebpf_api_tests Original-Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1643754 Original-Original-Revision: 95e3ee45e34a422f52c01bf3723e8d84c94bbcee GitOrigin-RevId: 0d7e71c8e06f3eb628a3e7dac562d6c870bd01f4 Change-Id: Ic84a412d2a79a1011f1ab7caea0de8525d8facb8 Reviewed-on: https://fuchsia-review.googlesource.com/c/integration/+/1645100 Cr-Commit-Position: refs/heads/main@{#194426}
This repository contains Fuchsia's Global Integration manifest files.
All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.
Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.
First install Jiri.
Next run:
$ jiri init $ jiri import minimal https://fuchsia.googlesource.com/integration $ jiri update
Third party projects should have their own subdirectory in ./third_party.