Martin Lau 4a6998aff8 bpf, btf: fix a missing check bug in btf_parse ... Wenwen Wang reported: In btf_parse(), the header of the user-space btf data 'btf_data' is firstly parsed and verified through btf_parse_hdr(). In btf_parse_hdr(), the header is copied from user-space 'btf_data' to kernel-space 'btf->hdr' and then verified. If no error happens during the verification process, the whole data of 'btf_data', including the header, is then copied to 'data' in btf_parse(). It is obvious that the header is copied twice here. More importantly, no check is enforced after the second copy to make sure the headers obtained in these two copies are same. Given that 'btf_data' resides in the user space, a malicious user can race to modify the header between these two copies. By doing so, the user can inject inconsistent data, which can cause undefined behavior of the kernel and introduce potential security risk. This issue is similar to the one fixed in commit 8af03d1ae2 ("bpf: btf: Fix a missing check bug"). To fix it, this patch copies the user 'btf_data' *before* parsing / verifying the BTF header. Fixes: 69b693f0ae ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by: Martin KaFai Lau <kafai@fb.com> Co-developed-by: Wenwen Wang <wang6495@umn.edu> Acked-by: Song Liu <songliubraving@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2018-10-26 00:42:03 +02:00
..
arraymap.c	bpf: return EOPNOTSUPP when map lookup isn't supported	2018-10-09 21:52:20 -07:00
bpf_lru_list.c	bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4	2017-04-17 13:55:52 -04:00
bpf_lru_list.h	bpf: Only set node->ref = 1 if it has not been set	2017-09-01 09:57:39 -07:00
btf.c	bpf, btf: fix a missing check bug in btf_parse	2018-10-26 00:42:03 +02:00
cgroup.c	bpf: add cg_skb_is_valid_access for BPF_PROG_TYPE_CGROUP_SKB	2018-10-19 13:49:34 -07:00
core.c	bpf: add queue and stack maps	2018-10-19 13:24:31 -07:00
cpumap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
devmap.c	bpf: devmap: fix wrong interface selection in notifier_call	2018-10-26 00:32:21 +02:00
disasm.c	bpf: Remove struct bpf_verifier_env argument from print_bpf_insn	2018-03-23 17:38:57 +01:00
disasm.h	bpf: Remove struct bpf_verifier_env argument from print_bpf_insn	2018-03-23 17:38:57 +01:00
hashtab.c	bpf: add bpffs pretty print for percpu arraymap/hash/lru_hash	2018-08-30 14:03:53 +02:00
helpers.c	bpf: add queue and stack maps	2018-10-19 13:24:31 -07:00
inode.c	bpf: decouple btf from seq bpf fs dump and enable more maps	2018-08-13 00:52:45 +02:00
local_storage.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2018-10-08 23:42:44 -07:00
lpm_trie.c	bpf: decouple btf from seq bpf fs dump and enable more maps	2018-08-13 00:52:45 +02:00
Makefile	bpf: add queue and stack maps	2018-10-19 13:24:31 -07:00
map_in_map.c	bpf: don't allow create maps of per-cpu cgroup local storages	2018-10-01 16:18:33 +02:00
map_in_map.h	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
offload.c	bpf: add verifier callback to get stack usage info for offloaded progs	2018-10-08 10:24:12 +02:00
percpu_freelist.c	bpf: fix lockdep splat	2017-11-15 19:46:32 +09:00
percpu_freelist.h
queue_stack_maps.c	bpf: add queue and stack maps	2018-10-19 13:24:31 -07:00
reuseport_array.c	bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY	2018-08-11 01:58:46 +02:00
stackmap.c	bpf: rename stack trace map operations	2018-10-19 13:24:30 -07:00
syscall.c	bpf: remove unused variable	2018-10-19 13:52:38 -07:00
tnum.c	bpf/verifier: improve register value range tracking with ARSH	2018-04-29 08:45:53 -07:00
verifier.c	bpf, verifier: avoid retpoline for map push/pop/peek operation	2018-10-20 23:13:32 -07:00
xskmap.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00