microsoft / microsoft/ebpf-for-windows
invalid handle race condition in ring buffer and perf buffer
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
Summary
ebpf_ring_buffer_set_wait_handle silently fails when passed ebpf_handle_invalid.
Problem
Invalid handle failure on cleanup
Both ring_buffer__free and perf_buffer__free call ebpf_map_set_wait_handle(..., ebpf_handle_invalid) to clear the wait event during teardown. The current code
passes (HANDLE)-1 directly to ObReferenceObjectByHandle, which fails in kernel mode, causing the cleanup to silently fail. The old event reference is leaked and the
stale pointer is never cleared from kernel_page->wait_event.
Note: This bug is masked in user-mode tests because the usersim ObReferenceObjectByHandle mock accepts any handle value including (HANDLE)-1.
Impact
- Affects both BPF_MAP_TYPE_RINGBUF and BPF_MAP_TYPE_PERF_EVENT_ARRAY (shared code path)
Contributor guide
Assessment
This issue has not been assessed yet.