Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
He Fengqing 004778bf39 bpf: Fix potential memleak and UAF in the verifier. ... [ Upstream commit 75f0fc7b48ad45a2e5736bcf8de26c8872fe8695 ] In bpf_patch_insn_data(), we first use the bpf_patch_insn_single() to insert new instructions, then use adjust_insn_aux_data() to adjust insn_aux_data. If the old env->prog have no enough room for new inserted instructions, we use bpf_prog_realloc to construct new_prog and free the old env->prog. There have two errors here. First, if adjust_insn_aux_data() return ENOMEM, we should free the new_prog. Second, if adjust_insn_aux_data() return ENOMEM, bpf_patch_insn_data() will return NULL, and env->prog has been freed in bpf_prog_realloc, but we will use it in bpf_check(). So in this patch, we make the adjust_insn_aux_data() never fails. In bpf_patch_insn_data(), we first pre-malloc memory for the new insn_aux_data, then call bpf_patch_insn_single() to insert new instructions, at last call adjust_insn_aux_data() to adjust insn_aux_data. Fixes: 8041902dae ("bpf: adjust insn_aux_data when patching insns") Signed-off-by: He Fengqing <hefengqing@huawei.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Song Liu <songliubraving@fb.com> Link: https://lore.kernel.org/bpf/20210714101815.164322-1-hefengqing@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-09-15 09:47:30 +02:00
..
arraymap.c
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 10:26:16 +01:00
bpf_lru_list.h
btf.c
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:25:27 +01:00
core.c	bpf: Fix up register-based shifts in interpreter to silence KUBSAN	2021-07-19 08:53:11 +02:00
cpumap.c	cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled	2020-05-02 08:48:51 +02:00
devmap.c	devmap: Use bpf_map_area_alloc() for allocating hash buckets	2020-06-30 15:36:56 -04:00
disasm.c
disasm.h
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2020-11-18 19:20:26 +01:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 15:57:56 +01:00
inode.c	bpf: Fix a rcu warning for bpffs map pretty-print	2020-10-01 13:18:19 +02:00
local_storage.c
lpm_trie.c
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-11-18 19:20:26 +01:00
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
queue_stack_maps.c
reuseport_array.c
stackmap.c	bpf: Check for integer overflow when using roundup_pow_of_two()	2021-02-17 10:35:16 +01:00
syscall.c	bpf: sockmap: Require attach_bpf_fd when detaching a program	2020-08-07 09:34:02 +02:00
sysfs_btf.c	bpf: Fix sysfs export of empty BTF section	2020-10-14 10:32:58 +02:00
tnum.c
verifier.c	bpf: Fix potential memleak and UAF in the verifier.	2021-09-15 09:47:30 +02:00
xskmap.c