Thadeu Lima de Souza Cascardo 1ca284f086 bpf, ringbuf: Deny reserve of buffers larger than ringbuf ... commit 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea upstream. A BPF program might try to reserve a buffer larger than the ringbuf size. If the consumer pointer is way ahead of the producer, that would be successfully reserved, allowing the BPF program to read or write out of the ringbuf allocated area. Reported-by: Ryota Shiga (Flatt Security) Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Andrii Nakryiko <andrii@kernel.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-14 09:50:45 +02:00
..
preload	bpf: Fix umd memory leak in copy_process()	2021-03-30 14:32:03 +02:00
arraymap.c	bpf: Allow for map-in-map with dynamic inner array map entries	2020-10-11 10:21:04 -07:00
bpf_inode_storage.c	bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF	2021-03-30 14:31:56 +02:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-03-04 11:37:33 +01:00
bpf_local_storage.c	bpf: Use hlist_add_head_rcu when linking to local_storage	2020-09-19 01:12:35 +02:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 11:37:29 +01:00
bpf_lru_list.h	bpf: Fix a typo "inacitve" -> "inactive"	2020-04-06 21:54:10 +02:00
bpf_lsm.c	bpf: Update verification logic for LSM programs	2020-11-06 13:15:21 -08:00
bpf_struct_ops_types.h	bpf: tcp: Support tcp_congestion_ops in bpf	2020-01-09 08:46:18 -08:00
bpf_struct_ops.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
btf.c	bpf: Introduce bpf_per_cpu_ptr()	2020-10-02 15:00:49 -07:00
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:29:12 +01:00
core.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
cpumap.c	bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature	2020-09-28 23:30:42 +02:00
devmap.c	bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation	2021-03-04 11:37:33 +01:00
disasm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
disasm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
dispatcher.c	bpf: Remove bpf_image tree	2020-03-13 12:49:52 -07:00
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2020-11-05 19:55:57 -08:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 16:03:59 +01:00
inode.c	bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET	2021-04-14 08:42:00 +02:00
local_storage.c	bpf/local_storage: Fix build without CONFIG_CGROUP	2020-07-25 20:16:36 -07:00
lpm_trie.c	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-10-29 20:01:46 -07:00
map_in_map.c	bpf: Relax max_entries check for most of the inner map types	2020-08-28 15:41:30 +02:00
map_in_map.h	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
map_iter.c	bpf: Implement link_query callbacks in map element iterators	2020-08-21 14:01:39 -07:00
net_namespace.c	bpf: Add support for forced LINK_DETACH command	2020-08-01 20:38:28 -07:00
offload.c	bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill	2020-02-17 16:53:49 +01:00
percpu_freelist.c	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
reuseport_array.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
ringbuf.c	bpf, ringbuf: Deny reserve of buffers larger than ringbuf	2021-05-14 09:50:45 +02:00
stackmap.c	bpf: Refcount task stack in bpf_get_task_stack	2021-04-14 08:42:01 +02:00
syscall.c	bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach	2021-01-27 11:55:07 +01:00
sysfs_btf.c	bpf: Fix sysfs export of empty BTF section	2020-09-21 21:50:24 +02:00
task_iter.c	bpf: Save correct stopping point in file seq iteration	2021-01-19 18:27:28 +01:00
tnum.c	bpf: Verifier, do explicit ALU32 bounds tracking	2020-03-30 14:59:53 -07:00
trampoline.c	bpf: Fix fexit trampoline.	2021-04-07 15:00:03 +02:00
verifier.c	bpf: Fix alu32 const subreg bound tracking on bitwise operations	2021-05-14 09:50:45 +02:00