[roll] Roll fuchsia [starnix][ebpf] Fix UAF in bpf_sk_storage_get

Register the ref-counted MapValueRef returned by map.lookup() in the
program's run context to ensure its lifetime extends to the end of
the program execution.

Previously, the temporary MapValueRef was dropped at the end of the
helper, decrementing the ref-count prematurely. If the entry was
deleted concurrently, it could be freed while the eBPF program still
held the raw pointer.

Added a regression unit test to verify that deleted socket storage
entries are not prematurely reused while the context is alive.

Original-Original-Fixed: b/518042596
Test: starnix_ebpf_api_tests
Original-Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1643754
Original-Original-Revision: 95e3ee45e34a422f52c01bf3723e8d84c94bbcee
GitOrigin-RevId: 0d7e71c8e06f3eb628a3e7dac562d6c870bd01f4
Change-Id: Ic84a412d2a79a1011f1ab7caea0de8525d8facb8
Reviewed-on: https://fuchsia-review.googlesource.com/c/integration/+/1645100
Cr-Commit-Position: refs/heads/main@{#194426}
1 file changed
tree: da3f0779b37a4318460c126b83297048bc16ade6
  1. ctf/
  2. git-hooks/
  3. infra/
  4. third_party/
  5. cobalt
  6. flower
  7. jiri.lock
  8. MILESTONE
  9. minimal
  10. prebuilts
  11. README.md
  12. stem
  13. test_durations
README.md

Integration

This repository contains Fuchsia's Global Integration manifest files.

Making changes

All changes should be made to the internal version of this repository. Our infrastructure automatically updates this version when the internal one changes.

Currently all changes must be made by a Google employee. Non-Google employees wishing to make a change can ask for assistance in one of the communication channels documented at get involved.

Obtaining the source

First install Jiri.

Next run:

$ jiri init
$ jiri import minimal https://fuchsia.googlesource.com/integration
$ jiri update

Third party

Third party projects should have their own subdirectory in ./third_party.