iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/kernel/bpf
History
Xu Kuohai be006212bd bpf: Do not copy spin lock field from user in bpf_selem_alloc 
[ Upstream commit 836e49e103dfeeff670c934b7d563cbd982fce87 ]

bpf_selem_alloc function is used by inode_storage, sk_storage and
task_storage maps to set map value, for these map types, there may
be a spin lock in the map value, so if we use memcpy to copy the whole
map value from user, the spin lock field may be initialized incorrectly.

Since the spin lock field is zeroed by kzalloc, call copy_map_value
instead of memcpy to skip copying the spin lock field to fix it.

Fixes: 6ac99e8f23d4 ("bpf: Introduce bpf sk local storage")
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20221114134720.1057939-2-xukuohai@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-08 11:23:55 +01:00
..
preload
bpf: Fix umd memory leak in copy_process()
2021-03-30 14:32:03 +02:00
arraymap.c
bpf: Acquire map uref in .init_seq_private for array map iterator
2022-08-25 11:37:55 +02:00
bpf_inode_storage.c
bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
2021-03-30 14:31:56 +02:00
bpf_iter.c
bpf: Fix an unitialized value in bpf_iter
2021-03-04 11:37:33 +01:00
bpf_local_storage.c
bpf: Do not copy spin lock field from user in bpf_selem_alloc
2022-12-08 11:23:55 +01:00
bpf_lru_list.c
bpf_lru_list: Read double-checked variable once without lock
2021-03-04 11:37:29 +01:00
bpf_lru_list.h
bpf: Fix a typo "inacitve" -> "inactive"
2020-04-06 21:54:10 +02:00
bpf_lsm.c
bpf: Update verification logic for LSM programs
2020-11-06 13:15:21 -08:00
bpf_struct_ops_types.h
bpf: tcp: Support tcp_congestion_ops in bpf
2020-01-09 08:46:18 -08:00
bpf_struct_ops.c
bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
2021-10-06 15:55:50 +02:00
btf.c
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
2022-10-26 13:25:20 +02:00
cgroup.c
bpf, cgroup: Fix kernel BUG in purge_effective_progs
2022-09-08 11:11:36 +02:00
core.c
bpf: Make sure mac_header was set before using it
2022-07-29 17:19:23 +02:00
cpumap.c
bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature
2020-09-28 23:30:42 +02:00
devmap.c
bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc
2021-12-17 10:14:41 +01:00
disasm.c
bpf: Introduce BPF nospec instruction for mitigating Spectre v4
2021-08-04 12:46:44 +02:00
disasm.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295
2019-06-05 17:36:38 +02:00
dispatcher.c
bpf: Remove bpf_image tree
2020-03-13 12:49:52 -07:00
hashtab.c
bpf: Acquire map uref in .init_seq_private for hash map iterator
2022-08-25 11:37:55 +02:00
helpers.c
bpf: Fix potentially incorrect results with bpf_get_local_storage()
2021-09-03 10:09:31 +02:00
inode.c
bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
2021-04-14 08:42:00 +02:00
local_storage.c
bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper
2021-09-03 10:09:21 +02:00
lpm_trie.c
bpf: Add map_meta_equal map ops
2020-08-28 15:41:30 +02:00
Makefile
bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
2020-10-29 20:01:46 -07:00
map_in_map.c
bpf: Relax max_entries check for most of the inner map types
2020-08-28 15:41:30 +02:00
map_in_map.h
bpf: Add map_meta_equal map ops
2020-08-28 15:41:30 +02:00
map_iter.c
bpf: Implement link_query callbacks in map element iterators
2020-08-21 14:01:39 -07:00
net_namespace.c
bpf: Add support for forced LINK_DETACH command
2020-08-01 20:38:28 -07:00
offload.c
bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill
2020-02-17 16:53:49 +01:00
percpu_freelist.c
bpf: Initialize same number of free nodes for each pcpu_freelist
2022-11-25 17:45:45 +01:00
percpu_freelist.h
bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI
2020-10-06 00:04:11 +02:00
prog_iter.c
bpf: Refactor bpf_iter_reg to have separate seq_info member
2020-07-25 20:16:32 -07:00
queue_stack_maps.c
bpf: Add map_meta_equal map ops
2020-08-28 15:41:30 +02:00
reuseport_array.c
bpf, net: Rework cookie generator as per-cpu one
2020-09-30 11:50:35 -07:00
ringbuf.c
bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
2022-02-08 18:30:39 +01:00
stackmap.c
bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()
2022-06-22 14:13:12 +02:00
syscall.c
bpf: Ensure correct locking around vulnerable function find_vpid()
2022-10-26 13:25:21 +02:00
sysfs_btf.c
bpf: Fix sysfs export of empty BTF section
2020-09-21 21:50:24 +02:00
task_iter.c
bpf: Save correct stopping point in file seq iteration
2021-01-19 18:27:28 +01:00
tnum.c
bpf: Verifier, do explicit ALU32 bounds tracking
2020-03-30 14:59:53 -07:00
trampoline.c
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
2022-06-06 08:42:45 +02:00
verifier.c
bpf: Fix wrong reg type conversion in release_reference()
2022-11-16 09:57:09 +01:00