Thadeu Lima de Souza Cascardo 1ca284f086 bpf, ringbuf: Deny reserve of buffers larger than ringbuf ... commit 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea upstream. A BPF program might try to reserve a buffer larger than the ringbuf size. If the consumer pointer is way ahead of the producer, that would be successfully reserved, allowing the BPF program to read or write out of the ringbuf allocated area. Reported-by: Ryota Shiga (Flatt Security) Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-14 09:50:45 +02:00
..
preload	bpf: Fix umd memory leak in copy_process()	2021-03-30 14:32:03 +02:00
arraymap.c	bpf: Allow for map-in-map with dynamic inner array map entries	2020-10-11 10:21:04 -07:00
bpf_inode_storage.c	bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF	2021-03-30 14:31:56 +02:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-03-04 11:37:33 +01:00
bpf_local_storage.c
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 11:37:29 +01:00
bpf_lru_list.h
bpf_lsm.c	bpf: Update verification logic for LSM programs	2020-11-06 13:15:21 -08:00
bpf_struct_ops_types.h
bpf_struct_ops.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
btf.c	bpf: Introduce bpf_per_cpu_ptr()	2020-10-02 15:00:49 -07:00
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:29:12 +01:00
core.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
cpumap.c	bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature	2020-09-28 23:30:42 +02:00
devmap.c	bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation	2021-03-04 11:37:33 +01:00
disasm.c
disasm.h
dispatcher.c
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2020-11-05 19:55:57 -08:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 16:03:59 +01:00
inode.c	bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET	2021-04-14 08:42:00 +02:00
local_storage.c
lpm_trie.c
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-10-29 20:01:46 -07:00
map_in_map.c
map_in_map.h
map_iter.c
net_namespace.c
offload.c
percpu_freelist.c	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c
queue_stack_maps.c
reuseport_array.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
ringbuf.c	bpf, ringbuf: Deny reserve of buffers larger than ringbuf	2021-05-14 09:50:45 +02:00
stackmap.c	bpf: Refcount task stack in bpf_get_task_stack	2021-04-14 08:42:01 +02:00
syscall.c	bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach	2021-01-27 11:55:07 +01:00
sysfs_btf.c
task_iter.c	bpf: Save correct stopping point in file seq iteration	2021-01-19 18:27:28 +01:00
tnum.c
trampoline.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
verifier.c	bpf: Fix alu32 const subreg bound tracking on bitwise operations	2021-05-14 09:50:45 +02:00