mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 10:40:15 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

bpf: Fix offset calculation error in __copy_map_value and zero_map_value

Browse source 
Function __copy_map_value and zero_map_value miscalculated copy offset,
resulting in possible copy of unwanted data to user or kernel.

Fix it.

Fixes: cc48755808 ("bpf: Add zero_map_value to zero map value with special fields")
Fixes: 4d7d7f69f4 ("bpf: Adapt copy_map_value for multiple offset case")
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20221111125620.754855-1-xukuohai@huaweicloud.com
This commit is contained in:
Xu Kuohai 2022-11-11 07:56:20 -05:00 committed by Andrii Nakryiko
parent 4b45cd81f7
commit 1f6e04a1c7
1 changed files with 2 additions and 2 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

4
include/linux/bpf.h
View file

@ -315,7 +315,7 @@ static inline void __copy_map_value(struct bpf_map *map, void *dst, void *src, b
u32 next_off = map->off_arr->field_off[i]; u32 next_off = map->off_arr->field_off[i];
memcpy(dst + curr_off, src + curr_off, next_off - curr_off); memcpy(dst + curr_off, src + curr_off, next_off - curr_off);
curr_off += map->off_arr->field_sz[i]; curr_off = next_off + map->off_arr->field_sz[i];
} }
memcpy(dst + curr_off, src + curr_off, map->value_size - curr_off); memcpy(dst + curr_off, src + curr_off, map->value_size - curr_off);
} }
@ -344,7 +344,7 @@ static inline void zero_map_value(struct bpf_map *map, void *dst)
u32 next_off = map->off_arr->field_off[i]; u32 next_off = map->off_arr->field_off[i];
memset(dst + curr_off, 0, next_off - curr_off); memset(dst + curr_off, 0, next_off - curr_off);
curr_off += map->off_arr->field_sz[i]; curr_off = next_off + map->off_arr->field_sz[i];
} }
memset(dst + curr_off, 0, map->value_size - curr_off); memset(dst + curr_off, 0, map->value_size - curr_off);
} }