bpf_test_finish()

bpf_test_finish()

[David Miller]

It dereferences a user pointer:

static int bpf_test_finish(union bpf_attr __user *uattr, const void *data,
			   u32 size, u32 retval, u32 duration)
{
	void __user *data_out = u64_to_user_ptr(uattr->test.data_out);
                                                ^^^^^^^^^^^^^^^^^^^^
Which of course doesn't work so well :-)

I really wish that didn't silently work on x86/x86_64.

You're going to have to do a "get_user(&uattr->test.data_out)"

Re: bpf_test_finish()

[Alexei Starovoitov]

On 5/1/17 8:56 PM, David Miller wrote:
>
> It dereferences a user pointer:
>
> static int bpf_test_finish(union bpf_attr __user *uattr, const void *data,
> 			   u32 size, u32 retval, u32 duration)
> {
> 	void __user *data_out = u64_to_user_ptr(uattr->test.data_out);
>                                                 ^^^^^^^^^^^^^^^^^^^^
> Which of course doesn't work so well :-)
>
> I really wish that didn't silently work on x86/x86_64.

argh. my bad.
I'll send a patch first thing tomorrow unless Daniel beats me to it.
We have kattr there as well which has the whole bpf_attr copied into
kernel memory already. Should have taken data_out from there and
passed into bpf_test_finish().

Re: bpf_test_finish()

[David Miller]

From: Alexei Starovoitov <ast@fb.com>
Date: Mon, 1 May 2017 21:46:07 -0700

> I'll send a patch first thing tomorrow unless Daniel beats me to it.
> We have kattr there as well which has the whole bpf_attr copied into
> kernel memory already. Should have taken data_out from there and
> passed into bpf_test_finish().

I happen to be hacking on this file for another reason right now so
I'll work on a fix for this.  So don't worry about it.