lkml.org 
[lkml]   [2021]   [Nov]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 062/125] bpf: Fix error usage of map_fd and fdget() in generic_map_update_batch()
    Date
    From: Xu Kuohai <xukuohai@huawei.com>

    commit fda7a38714f40b635f5502ec4855602c6b33dad2 upstream.

    1. The ufd in generic_map_update_batch() should be read from batch.map_fd;
    2. A call to fdget() should be followed by a symmetric call to fdput().

    Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops")
    Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20211019032934.1210517-1-xukuohai@huawei.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/syscall.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/kernel/bpf/syscall.c
    +++ b/kernel/bpf/syscall.c
    @@ -1333,12 +1333,11 @@ int generic_map_update_batch(struct bpf_
    void __user *values = u64_to_user_ptr(attr->batch.values);
    void __user *keys = u64_to_user_ptr(attr->batch.keys);
    u32 value_size, cp, max_count;
    - int ufd = attr->map_fd;
    + int ufd = attr->batch.map_fd;
    void *key, *value;
    struct fd f;
    int err = 0;

    - f = fdget(ufd);
    if (attr->batch.elem_flags & ~BPF_F_LOCK)
    return -EINVAL;

    @@ -1363,6 +1362,7 @@ int generic_map_update_batch(struct bpf_
    return -ENOMEM;
    }

    + f = fdget(ufd); /* bpf_map_do_batch() guarantees ufd is valid */
    for (cp = 0; cp < max_count; cp++) {
    err = -EFAULT;
    if (copy_from_user(key, keys + cp * map->key_size,
    @@ -1382,6 +1382,7 @@ int generic_map_update_batch(struct bpf_

    kfree(value);
    kfree(key);
    + fdput(f);
    return err;
    }


    \
     
     \ /
      Last update: 2021-11-01 10:47    [W:2.605 / U:22.548 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site