Daniel Borkmann 9975a54b3c bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_len
bpf_prog_size(prog->len) is not the correct length we want to dump
back to user space. The code in bpf_prog_get_info_by_fd() uses this
to copy prog->insnsi to user space, but bpf_prog_size(prog->len) also
includes the size of struct bpf_prog itself plus program instructions
and is usually used either in context of accounting or for bpf_prog_alloc()
et al, thus we copy out of bounds in bpf_prog_get_info_by_fd()
potentially. Use the correct bpf_prog_insn_size() instead.

Fixes: 1e2709769086 ("bpf: Add BPF_OBJ_GET_INFO_BY_FD")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-07-29 23:29:41 -07:00
..
2017-05-12 15:57:15 -07:00
2017-07-13 13:17:19 -07:00
2017-05-23 10:01:37 +02:00
2017-06-12 18:07:43 -04:00
2017-05-18 10:30:19 -06:00
2017-05-08 17:15:12 -07:00
2017-07-14 15:05:13 -07:00
2017-07-12 17:22:01 -07:00
2017-07-06 16:24:33 -07:00
2017-07-12 09:15:00 -07:00