Alexei Starovoitov 0911287ce3 bpf: fix bpf_prog_array_copy_to_user() issues ... 1. move copy_to_user out of rcu section to fix the following issue: ./include/linux/rcupdate.h:302 Illegal context switch in RCU read-side critical section! stack backtrace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4592 rcu_preempt_sleep_check include/linux/rcupdate.h:301 [inline] ___might_sleep+0x385/0x470 kernel/sched/core.c:6079 __might_sleep+0x95/0x190 kernel/sched/core.c:6067 __might_fault+0xab/0x1d0 mm/memory.c:4532 _copy_to_user+0x2c/0xc0 lib/usercopy.c:25 copy_to_user include/linux/uaccess.h:155 [inline] bpf_prog_array_copy_to_user+0x217/0x4d0 kernel/bpf/core.c:1587 bpf_prog_array_copy_info+0x17b/0x1c0 kernel/bpf/core.c:1685 perf_event_query_prog_array+0x196/0x280 kernel/trace/bpf_trace.c:877 _perf_ioctl kernel/events/core.c:4737 [inline] perf_ioctl+0x3e1/0x1480 kernel/events/core.c:4757 2. move *prog under rcu, since it's not ok to dereference it afterwards 3. in a rare case of prog array being swapped between bpf_prog_array_length() and bpf_prog_array_copy_to_user() calls make sure to copy zeros to user space, so the user doesn't walk over uninited prog_ids while kernel reported uattr->query.prog_cnt > 0 Reported-by: syzbot+7dbcd2d3b85f9b608b23@syzkaller.appspotmail.com Fixes: 468e2f64d2 ("bpf: introduce BPF_PROG_QUERY command") Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2018-02-03 01:49:21 +01:00
..
arraymap.c	bpf: arraymap: use bpf_map_init_from_attr()	2018-01-18 22:54:25 +01:00
bpf_lru_list.c	bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4	2017-04-17 13:55:52 -04:00
bpf_lru_list.h	bpf: Only set node->ref = 1 if it has not been set	2017-09-01 09:57:39 -07:00
cgroup.c	bpf/cgroup: fix a verification error for a CGROUP_DEVICE type prog	2017-12-19 01:43:29 +01:00
core.c	bpf: fix bpf_prog_array_copy_to_user() issues	2018-02-03 01:49:21 +01:00
cpumap.c	bpf: cpumap: make some functions static	2018-01-17 00:12:58 +01:00
devmap.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
disasm.c	bpf: allow for correlation of maps and helpers in dump	2017-12-20 18:09:40 -08:00
disasm.h	bpf: annotate bpf_insn_print_t with __printf	2018-01-17 01:15:05 +01:00
hashtab.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
helpers.c	bpf: rename ARG_PTR_TO_STACK	2017-01-09 16:56:27 -05:00
inode.c	Merge branch 'work.mqueue' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-01-30 18:32:21 -08:00
lpm_trie.c	bpf: fix kernel page fault in lpm map trie_get_next_key	2018-01-26 17:06:22 -08:00
Makefile	bpf: only build sockmap with CONFIG_INET	2018-01-04 19:01:14 +01:00
map_in_map.c	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
map_in_map.h	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
offload.c	bpf: offload: report device information about offloaded maps	2018-01-18 22:54:25 +01:00
percpu_freelist.c	bpf: fix lockdep splat	2017-11-15 19:46:32 +09:00
percpu_freelist.h	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
sockmap.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
stackmap.c	bpf: add helper for copying attrs to struct bpf_map	2018-01-14 23:36:29 +01:00
syscall.c	bpf: Use the IS_FD_ARRAY() macro in map_update_elem()	2018-01-25 18:05:24 -08:00
tnum.c	bpf/verifier: track signed and unsigned min/max values	2017-08-08 17:51:34 -07:00
verifier.c	bpf: fix subprog verifier bypass by div/mod by 0 exception	2018-01-26 16:42:05 -08:00