microsoft / microsoft/ebpf-for-windows

invalid handle race condition in ring buffer and perf buffer

Open
#5,206 1 comment 0 reactions 1 assignee Claimed by @mikeagun View on GitHub
bug P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

Summary

ebpf_ring_buffer_set_wait_handle silently fails when passed ebpf_handle_invalid.

Problem

Invalid handle failure on cleanup

Both ring_buffer__free and perf_buffer__free call ebpf_map_set_wait_handle(..., ebpf_handle_invalid) to clear the wait event during teardown. The current code
passes (HANDLE)-1 directly to ObReferenceObjectByHandle, which fails in kernel mode, causing the cleanup to silently fail. The old event reference is leaked and the
stale pointer is never cleared from kernel_page->wait_event.

Note: This bug is masked in user-mode tests because the usersim ObReferenceObjectByHandle mock accepts any handle value including (HANDLE)-1.

Impact

- Affects both BPF_MAP_TYPE_RINGBUF and BPF_MAP_TYPE_PERF_EVENT_ARRAY (shared code path)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.