Commit 2ba5622f authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 



Daniel Borkmann says:

====================
pull-request: bpf 2018-05-05

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Sanitize attr->{prog,map}_type from bpf(2) since used as an array index
   to retrieve prog/map specific ops such that we prevent potential out of
   bounds value under speculation, from Mark and Daniel.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 52c5cd1b d0f1a451

kernel/bpf/syscall.c

+14 −5
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/cred.h>

#include <linux/timekeeping.h>

#include <linux/ctype.h>

#include <linux/nospec.h>



#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \

			   (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
@@ -102,12 +103,14 @@ const struct bpf_map_ops bpf_map_offload_ops = { 
static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)

{

	const struct bpf_map_ops *ops;

	u32 type = attr->map_type;

	struct bpf_map *map;

	int err;



	if (attr->map_type >= ARRAY_SIZE(bpf_map_types))

	if (type >= ARRAY_SIZE(bpf_map_types))

		return ERR_PTR(-EINVAL);

	ops = bpf_map_types[attr->map_type];

	type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types));

	ops = bpf_map_types[type];

	if (!ops)

		return ERR_PTR(-EINVAL);
@@ -122,7 +125,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) 
	if (IS_ERR(map))

		return map;

	map->ops = ops;

	map->map_type = attr->map_type;

	map->map_type = type;

	return map;

}
@@ -871,11 +874,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = { 


static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)

{

	if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])

	const struct bpf_prog_ops *ops;



	if (type >= ARRAY_SIZE(bpf_prog_types))

		return -EINVAL;

	type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));

	ops = bpf_prog_types[type];

	if (!ops)

		return -EINVAL;



	if (!bpf_prog_is_dev_bound(prog->aux))

		prog->aux->ops = bpf_prog_types[type];

		prog->aux->ops = ops;

	else

		prog->aux->ops = &bpf_offload_prog_ops;

	prog->type = type;

CRA Git | Maintained and supported by SUSTech CRA and CCSE