Commit 2ba5622f authored by David S. Miller's avatar David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
pull-request: bpf 2018-05-05

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Sanitize attr->{prog,map}_type from bpf(2) since used as an array index
   to retrieve prog/map specific ops such that we prevent potential out of
   bounds value under speculation, from Mark and Daniel.
====================
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 52c5cd1b d0f1a451
...@@ -26,6 +26,7 @@ ...@@ -26,6 +26,7 @@
#include <linux/cred.h> #include <linux/cred.h>
#include <linux/timekeeping.h> #include <linux/timekeeping.h>
#include <linux/ctype.h> #include <linux/ctype.h>
#include <linux/nospec.h>
#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \ #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \
(map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \ (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
...@@ -102,12 +103,14 @@ const struct bpf_map_ops bpf_map_offload_ops = { ...@@ -102,12 +103,14 @@ const struct bpf_map_ops bpf_map_offload_ops = {
static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
{ {
const struct bpf_map_ops *ops; const struct bpf_map_ops *ops;
u32 type = attr->map_type;
struct bpf_map *map; struct bpf_map *map;
int err; int err;
if (attr->map_type >= ARRAY_SIZE(bpf_map_types)) if (type >= ARRAY_SIZE(bpf_map_types))
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
ops = bpf_map_types[attr->map_type]; type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types));
ops = bpf_map_types[type];
if (!ops) if (!ops)
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
...@@ -122,7 +125,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) ...@@ -122,7 +125,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
if (IS_ERR(map)) if (IS_ERR(map))
return map; return map;
map->ops = ops; map->ops = ops;
map->map_type = attr->map_type; map->map_type = type;
return map; return map;
} }
...@@ -871,11 +874,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = { ...@@ -871,11 +874,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = {
static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog) static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
{ {
if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type]) const struct bpf_prog_ops *ops;
if (type >= ARRAY_SIZE(bpf_prog_types))
return -EINVAL;
type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));
ops = bpf_prog_types[type];
if (!ops)
return -EINVAL; return -EINVAL;
if (!bpf_prog_is_dev_bound(prog->aux)) if (!bpf_prog_is_dev_bound(prog->aux))
prog->aux->ops = bpf_prog_types[type]; prog->aux->ops = ops;
else else
prog->aux->ops = &bpf_offload_prog_ops; prog->aux->ops = &bpf_offload_prog_ops;
prog->type = type; prog->type = type;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment