Daniel Borkmann 9975a54b3c bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_len ...

bpf_prog_size(prog->len) is not the correct length we want to dump
back to user space. The code in bpf_prog_get_info_by_fd() uses this
to copy prog->insnsi to user space, but bpf_prog_size(prog->len) also
includes the size of struct bpf_prog itself plus program instructions
and is usually used either in context of accounting or for bpf_prog_alloc()
et al, thus we copy out of bounds in bpf_prog_get_info_by_fd()
potentially. Use the correct bpf_prog_insn_size() instead.

Fixes: 1e2709769086 ("bpf: Add BPF_OBJ_GET_INFO_BY_FD")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2017-07-29 23:29:41 -07:00

..

arraymap.c

bpf: Add syscall lookup support for fd array and htab

2017-06-29 13:13:25 -04:00

bpf_lru_list.c

bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4

2017-04-17 13:55:52 -04:00

bpf_lru_list.h

bpf: Add percpu LRU list

2016-11-15 11:50:20 -05:00

cgroup.c

bpf: BPF support for sock_ops

2017-07-01 16:15:13 -07:00

core.c

bpf: Fix out-of-bound access on interpreters[]

2017-06-29 15:37:04 -04:00

hashtab.c

bpf: Add syscall lookup support for fd array and htab

2017-06-29 13:13:25 -04:00

helpers.c

bpf: rename ARG_PTR_TO_STACK

2017-01-09 16:56:27 -05:00

inode.c

bpf: Implement show_options

2017-07-06 03:31:46 -04:00

lpm_trie.c

bpf: fix wrong exposure of map_flags into fdinfo for lpm

2017-05-25 13:44:28 -04:00

Makefile

bpf: Add array of maps support

2017-03-22 15:45:45 -07:00

map_in_map.c

bpf: Add syscall lookup support for fd array and htab

2017-06-29 13:13:25 -04:00

map_in_map.h

bpf: Add syscall lookup support for fd array and htab

2017-06-29 13:13:25 -04:00

percpu_freelist.c

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

percpu_freelist.h

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

stackmap.c

bpf: fix wrong exposure of map_flags into fdinfo for lpm

2017-05-25 13:44:28 -04:00

syscall.c

bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_len

2017-07-29 23:29:41 -07:00

verifier.c

bpf/verifier: fix min/max handling in BPF_SUB

2017-07-24 14:02:55 -07:00