diff options
| author |   Stanislav Fomichev <sdf@google.com> | 2022-02-28 15:23:32 -0800 |
|---|---|---|
| committer |   Daniel Borkmann <daniel@iogearbox.net> | 2022-03-02 01:09:15 +0100 |
| commit | 530e214c5b5acbfaf819d884b196f3c61f5eca3d (patch) | |
| tree | b74928a2048b7d594ff7978cb88aaa1a38d7bba6 /net/bpf/test_run.c | |
| parent | selftests/bpf: Update btf_dump case for conflicting names (diff) | |
| download | linux-dev-530e214c5b5acbfaf819d884b196f3c61f5eca3d.tar.xz linux-dev-530e214c5b5acbfaf819d884b196f3c61f5eca3d.zip | |
bpf, test_run: Fix overflow in XDP frags bpf_test_finish
Syzkaller reports another issue:
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
check_copy_size include/linux/thread_info.h:230 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
copy_to_user include/linux/uaccess.h:199 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
bpf_test_finish.isra.0+0x4b2/0x680 net/bpf/test_run.c:171
This can happen when the userspace buffer is smaller than head + frags.
Return ENOSPC in this case.
Fixes: 7855e0db150a ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Reported-by: syzbot+5f81df6205ecbbc56ab5@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/bpf/20220228232332.458871-1-sdf@google.com
Diffstat (limited to 'net/bpf/test_run.c')
| -rw-r--r-- | net/bpf/test_run.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c index f08034500813..eb129e48f90b 100644 --- a/net/bpf/test_run.c +++ b/net/bpf/test_run.c @@ -150,6 +150,11 @@ static int bpf_test_finish(const union bpf_attr *kattr, if (data_out) { int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size; + if (len < 0) { + err = -ENOSPC; + goto out; + } + if (copy_to_user(data_out, data, len)) goto out; |