diff options
| author |   Yuntao Wang <ytcoode@gmail.com> | 2022-04-30 21:08:03 +0800 |
|---|---|---|
| committer |   Alexei Starovoitov <ast@kernel.org> | 2022-05-11 21:24:20 -0700 |
| commit | a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d (patch) | |
| tree | 7fe531debdf3412e10287ed5d4745c6a6eafdd57 /tools/perf/scripts/python/export-to-sqlite.py | |
| parent | selftests/bpf: make fexit_stress test run in serial mode (diff) | |
| download | linux-dev-a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d.tar.xz linux-dev-a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d.zip | |
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
can exceed BPF_MAX_TRAMP_PROGS.
When this happens, the assignment '*progs++ = aux->prog' in
bpf_trampoline_get_progs() will cause progs array overflow as the
progs field in the bpf_tramp_progs struct can only hold at most
BPF_MAX_TRAMP_PROGS bpf programs.
Fixes: 88fd9e5352fe ("bpf: Refactor trampoline update code")
Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
Link: https://lore.kernel.org/r/20220430130803.210624-1-ytcoode@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/export-to-sqlite.py')
0 files changed, 0 insertions, 0 deletions