• Daniel Borkmann's avatar
    bpf: fix leaking uninitialized memory on pop/peek helpers · d3f66e41
    Daniel Borkmann authored
    Commit f1a2e44a ("bpf: add queue and stack maps") added helpers
    with ARG_PTR_TO_UNINIT_MAP_VALUE. Meaning, the helper is supposed to
    fill the map value buffer with data instead of reading from it like
    in other helpers such as map update. However, given the buffer is
    allowed to be uninitialized (since we fill it in the helper anyway),
    it also means that the helper is obliged to wipe the memory in case
    of an error in order to not allow for leaking uninitialized memory.
    Given pop/peek is both handled inside __{stack,queue}_map_get(),
    lets wipe it there on error case, that is, empty stack/queue.
    
    Fixes: f1a2e44a ("bpf: add queue and stack maps")
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Cc: Mauricio Vasquez B <mauricio.vasquez@polito.it>
    Acked-by: Mauricio Vasquez B<mauricio.vasquez@polito.it>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    d3f66e41
queue_stack_maps.c 6.77 KB