]> git.baikalelectronics.ru Git - kernel.git/commit
bpf, test_run: Fix overflow in XDP frags bpf_test_finish
authorStanislav Fomichev <sdf@google.com>
Mon, 28 Feb 2022 23:23:32 +0000 (15:23 -0800)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 2 Mar 2022 00:09:15 +0000 (01:09 +0100)
commit1b748154fa2c834da6deb59611f559a6e75aaa7e
treeb74928a2048b7d594ff7978cb88aaa1a38d7bba6
parent93f536adaee73283c236336c9820d57856892ba1
bpf, test_run: Fix overflow in XDP frags bpf_test_finish

Syzkaller reports another issue:

WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
check_copy_size include/linux/thread_info.h:230 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
copy_to_user include/linux/uaccess.h:199 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
bpf_test_finish.isra.0+0x4b2/0x680 net/bpf/test_run.c:171

This can happen when the userspace buffer is smaller than head + frags.
Return ENOSPC in this case.

Fixes: 6015b81697d4 ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Reported-by: syzbot+5f81df6205ecbbc56ab5@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/bpf/20220228232332.458871-1-sdf@google.com
net/bpf/test_run.c