diff options
| author | Thadeu Lima de Souza Cascardo <cascardo@canonical.com> | 2021-04-27 10:12:12 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-14 09:50:45 +0200 |
| commit | 1ca284f0867079a34f52a6f811747695828166c6 (patch) | |
| tree | a6285cef2438e088cff276a7a99065edecc5bca0 | |
| parent | 282bfc8848eaa195d5e994bb700f2c7afb7eb3e6 (diff) | |
| download | kernel_replicant_linux-1ca284f0867079a34f52a6f811747695828166c6.tar.gz kernel_replicant_linux-1ca284f0867079a34f52a6f811747695828166c6.tar.bz2 kernel_replicant_linux-1ca284f0867079a34f52a6f811747695828166c6.zip | |
bpf, ringbuf: Deny reserve of buffers larger than ringbuf
commit 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea upstream.
A BPF program might try to reserve a buffer larger than the ringbuf size.
If the consumer pointer is way ahead of the producer, that would be
successfully reserved, allowing the BPF program to read or write out of
the ringbuf allocated area.
Reported-by: Ryota Shiga (Flatt Security)
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | kernel/bpf/ringbuf.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 31cb04a4dd2d..51d0eb881ed3 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -334,6 +334,9 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) return NULL; len = round_up(size + BPF_RINGBUF_HDR_SZ, 8); + if (len > rb->mask + 1) + return NULL; + cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { |