]> git.baikalelectronics.ru Git - kernel.git/commit
bpf, ringbuf: Deny reserve of buffers larger than ringbuf
authorThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Tue, 27 Apr 2021 13:12:12 +0000 (10:12 -0300)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 11 May 2021 11:30:45 +0000 (13:30 +0200)
commit4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
treed6a39026c5a8218d08d1038b967088eaf597d088
parent049c4e13714ecbca567b4d5f6d563f05d431c80e
bpf, ringbuf: Deny reserve of buffers larger than ringbuf

A BPF program might try to reserve a buffer larger than the ringbuf size.
If the consumer pointer is way ahead of the producer, that would be
successfully reserved, allowing the BPF program to read or write out of
the ringbuf allocated area.

Reported-by: Ryota Shiga (Flatt Security)
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/ringbuf.c