Yonghong Song 94c0e35515 bpf: Fix an unitialized value in bpf_iter ... [ Upstream commit 17d8beda277a36203585943e70c7909b60775fd5 ] Commit 15d83c4d7c ("bpf: Allow loading of a bpf_iter program") cached btf_id in struct bpf_iter_target_info so later on if it can be checked cheaply compared to checking registered names. syzbot found a bug that uninitialized value may occur to bpf_iter_target_info->btf_id. This is because we allocated bpf_iter_target_info structure with kmalloc and never initialized field btf_id afterwards. This uninitialized btf_id is typically compared to a u32 bpf program func proto btf_id, and the chance of being equal is extremely slim. This patch fixed the issue by using kzalloc which will also prevent future likely instances due to adding new fields. Fixes: 15d83c4d7c ("bpf: Allow loading of a bpf_iter program") Reported-by: syzbot+580f4f2a272e452d55cb@syzkaller.appspotmail.com Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210212005926.2875002-1-yhs@fb.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-03-04 11:37:33 +01:00
..
preload	bpf, preload: Fix build when $(O) points to a relative path	2021-02-10 09:29:13 +01:00
arraymap.c	bpf: Allow for map-in-map with dynamic inner array map entries	2020-10-11 10:21:04 -07:00
bpf_inode_storage.c	bpf, inode_storage: Put file handler if no storage was found	2021-02-10 09:29:12 +01:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-03-04 11:37:33 +01:00
bpf_local_storage.c
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 11:37:29 +01:00
bpf_lru_list.h
bpf_lsm.c	bpf: Update verification logic for LSM programs	2020-11-06 13:15:21 -08:00
bpf_struct_ops_types.h
bpf_struct_ops.c
btf.c
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:29:12 +01:00
core.c	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-10-29 20:01:46 -07:00
cpumap.c
devmap.c
disasm.c
disasm.h
dispatcher.c
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2020-11-05 19:55:57 -08:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 16:03:59 +01:00
inode.c
local_storage.c
lpm_trie.c
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-10-29 20:01:46 -07:00
map_in_map.c
map_in_map.h
map_iter.c
net_namespace.c
offload.c
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
reuseport_array.c
ringbuf.c
stackmap.c	bpf: Check for integer overflow when using roundup_pow_of_two()	2021-02-17 11:02:25 +01:00
syscall.c	bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach	2021-01-27 11:55:07 +01:00
sysfs_btf.c
task_iter.c	bpf: Save correct stopping point in file seq iteration	2021-01-19 18:27:28 +01:00
tnum.c
trampoline.c
verifier.c	bpf: Fix truncation handling for mod32 dst reg wrt zero	2021-02-26 10:12:59 +01:00