]> git.ipfire.org Git - people/arne_f/kernel.git/commit
bpf: Fix ringbuf helper function compatibility
authorDaniel Borkmann <daniel@iogearbox.net>
Mon, 23 Aug 2021 19:02:09 +0000 (21:02 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Sep 2021 08:09:21 +0000 (10:09 +0200)
commit9dd6f6d89693d8f09af53d2488afad22a8a44a57
treeb141555f419f1ee6ceb39139a3a1178a1a7e8e93
parentad41706c771a038e9a334fa55216abd69b32bfdf
bpf: Fix ringbuf helper function compatibility

commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream.

Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support
for it") extended check_map_func_compatibility() by enforcing map -> helper
function match, but not helper -> map type match.

Due to this all of the bpf_ringbuf_*() helper functions could be used with
a wrong map type such as array or hash map, leading to invalid access due
to type confusion.

Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as
argument and not a BPF map. Therefore, their check_map_func_compatibility()
presence is incorrect since it's only for map type checking.

Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: Ryota Shiga (Flatt Security)
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/bpf/verifier.c