github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 07:03:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
Linux kernel source tree
792,925 Commits 1 Branch 934 Tags 20 GiB
C 97%
Assembly 1%
Shell 0.6%
Rust 0.5%
Python 0.4%
Other 0.3%
54299e1cf3
Go to file
Martin Lau 54299e1cf3 bpf, btf: fix a missing check bug in btf_parse 
[ Upstream commit 4a6998aff8 ]

Wenwen Wang reported:

  In btf_parse(), the header of the user-space btf data 'btf_data'
  is firstly parsed and verified through btf_parse_hdr().
  In btf_parse_hdr(), the header is copied from user-space 'btf_data'
  to kernel-space 'btf->hdr' and then verified. If no error happens
  during the verification process, the whole data of 'btf_data',
  including the header, is then copied to 'data' in btf_parse(). It
  is obvious that the header is copied twice here. More importantly,
  no check is enforced after the second copy to make sure the headers
  obtained in these two copies are same. Given that 'btf_data' resides
  in the user space, a malicious user can race to modify the header
  between these two copies. By doing so, the user can inject
  inconsistent data, which can cause undefined behavior of the
  kernel and introduce potential security risk.

This issue is similar to the one fixed in commit 8af03d1ae2 ("bpf:
btf: Fix a missing check bug"). To fix it, this patch copies the user
'btf_data' *before* parsing / verifying the BTF header.

Fixes: 69b693f0ae ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Co-developed-by: Wenwen Wang <wang6495@umn.edu>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-12-01 09:17:01 +01:00
arch RISC-V: Avoid corrupting the upper 32-bit of phys_addr_t in ioremap 2019-12-01 09:16:53 +01:00
block blok, bfq: do not plug I/O if all queues are weight-raised 2019-11-20 18:46:44 +01:00
certs export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR() 2018-08-22 23:21:44 +09:00
crypto crypto: testmgr - fix sizeof() on COMP_BUF_SIZE 2019-12-01 09:16:13 +01:00
Documentation spi: uniphier: fix incorrect property items 2019-12-01 09:16:58 +01:00
drivers net: ethernet: cadence: fix socket buffer corruption problem 2019-12-01 09:17:00 +01:00
firmware kbuild: remove all dummy assignments to obj- 2017-11-18 11:46:06 +09:00
fs fs/cifs: fix uninitialised variable warnings 2019-12-01 09:16:58 +01:00
include mfd: max8997: Enale irq-wakeup unconditionally 2019-12-01 09:16:57 +01:00
init initramfs: don't free a non-existent initrd 2019-10-01 08:26:09 +02:00
ipc ipc/mqueue.c: only perform resource calculation if user valid 2019-08-06 19:06:52 +02:00
kernel bpf, btf: fix a missing check bug in btf_parse 2019-12-01 09:17:01 +01:00
lib idr: Fix idr_get_next race with idr_remove 2019-11-24 08:19:11 +01:00
LICENSES LICENSES: Remove CC-BY-SA-4.0 license text 2018-10-18 11:28:50 +02:00
mm mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() 2019-12-01 09:16:11 +01:00
net sunrpc: safely reallow resvport min/max inversion 2019-12-01 09:16:41 +01:00
samples mei: samples: fix a signedness bug in amt_host_if_call() 2019-11-24 08:19:50 +01:00
scripts scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks 2019-11-06 13:05:27 +01:00
security ima: fix freeing ongoing ahash_request 2019-10-11 18:21:11 +02:00
sound ALSA: i2c/cs8427: Fix int to char conversion 2019-12-01 09:16:36 +01:00
tools selftests: fix warning: "_GNU_SOURCE" redefined 2019-12-01 09:17:00 +01:00
usr kbuild: clean compressed initramfs image 2019-10-07 18:57:16 +02:00
virt kvm: arm/arm64: Fix stage2_flush_memslot for 4 level page table 2019-11-24 08:19:31 +01:00
.clang-format clang-format: Set IndentWrappedFunctionNames false 2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore Kbuild updates for v4.17 (2nd) 2018-04-15 17:21:30 -07:00
.mailmap libnvdimm-for-4.19_misc 2018-08-25 18:13:10 -07:00
COPYING COPYING: use the new text with points to the license files 2018-03-23 12:41:45 -06:00
CREDITS 9p: remove Ron Minnich from MAINTAINERS 2018-08-17 16:20:26 -07:00
Kbuild Kbuild updates for v4.15 2017-11-17 17:45:29 -08:00
Kconfig kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt 2018-08-02 08:06:55 +09:00
MAINTAINERS USB: rio500: Remove Rio 500 kernel driver 2019-10-17 13:44:47 -07:00
Makefile Linux 4.19.86 2019-11-24 08:21:09 +01:00
README Docs: Added a pointer to the formatted docs to README 2018-03-21 09:02:53 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.