* [PATCH bpf-next] bpf, xskmap: fix crash in xsk_map_alloc error path handling
@ 2018-05-04 14:27 Daniel Borkmann
2018-05-04 15:39 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Daniel Borkmann @ 2018-05-04 14:27 UTC (permalink / raw)
To: alexei.starovoitov; +Cc: netdev, Daniel Borkmann, Björn Töpel
If bpf_map_precharge_memlock() did not fail, then we set err to zero.
However, any subsequent failure from either alloc_percpu() or the
bpf_map_area_alloc() will return ERR_PTR(0) which in find_and_alloc_map()
will cause NULL pointer deref.
In devmap we have the convention that we return -EINVAL on page count
overflow, so keep the same logic here and just set err to -ENOMEM
after successful bpf_map_precharge_memlock().
Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Björn Töpel <bjorn.topel@intel.com>
---
kernel/bpf/xskmap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/bpf/xskmap.c b/kernel/bpf/xskmap.c
index 869dbb1..cb3a121 100644
--- a/kernel/bpf/xskmap.c
+++ b/kernel/bpf/xskmap.c
@@ -56,6 +56,8 @@ static struct bpf_map *xsk_map_alloc(union bpf_attr *attr)
if (err)
goto free_m;
+ err = -ENOMEM;
+
m->flush_list = alloc_percpu(struct list_head);
if (!m->flush_list)
goto free_m;
--
2.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH bpf-next] bpf, xskmap: fix crash in xsk_map_alloc error path handling
2018-05-04 14:27 [PATCH bpf-next] bpf, xskmap: fix crash in xsk_map_alloc error path handling Daniel Borkmann
@ 2018-05-04 15:39 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2018-05-04 15:39 UTC (permalink / raw)
To: daniel; +Cc: alexei.starovoitov, netdev, bjorn.topel
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Fri, 4 May 2018 16:27:53 +0200
> If bpf_map_precharge_memlock() did not fail, then we set err to zero.
> However, any subsequent failure from either alloc_percpu() or the
> bpf_map_area_alloc() will return ERR_PTR(0) which in find_and_alloc_map()
> will cause NULL pointer deref.
>
> In devmap we have the convention that we return -EINVAL on page count
> overflow, so keep the same logic here and just set err to -ENOMEM
> after successful bpf_map_precharge_memlock().
>
> Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP")
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: David S. Miller <davem@davemloft.net>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-05-04 15:39 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-04 14:27 [PATCH bpf-next] bpf, xskmap: fix crash in xsk_map_alloc error path handling Daniel Borkmann
2018-05-04 15:39 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.