lkml.org 
[lkml]   [2021]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 47/55] media, bpf: Do not copy more entries than user space requested
    Date
    From: Sean Young <sean@mess.org>

    [ Upstream commit 647d446d66e493d23ca1047fa8492b0269674530 ]

    The syscall bpf(BPF_PROG_QUERY, &attr) should use the prog_cnt field to
    see how many entries user space provided and return ENOSPC if there are
    more programs than that. Before this patch, this is not checked and
    ENOSPC is never returned.

    Note that one lirc device is limited to 64 bpf programs, and user space
    I'm aware of -- ir-keytable -- always gives enough space for 64 entries
    already. However, we should not copy program ids than are requested.

    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Link: https://lore.kernel.org/bpf/20210623213754.632-1-sean@mess.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/rc/bpf-lirc.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/rc/bpf-lirc.c b/drivers/media/rc/bpf-lirc.c
    index 8b97fd1f0cea..5a0e26e47f59 100644
    --- a/drivers/media/rc/bpf-lirc.c
    +++ b/drivers/media/rc/bpf-lirc.c
    @@ -295,7 +295,8 @@ int lirc_prog_query(const union bpf_attr *attr, union bpf_attr __user *uattr)
    }

    if (attr->query.prog_cnt != 0 && prog_ids && cnt)
    - ret = bpf_prog_array_copy_to_user(progs, prog_ids, cnt);
    + ret = bpf_prog_array_copy_to_user(progs, prog_ids,
    + attr->query.prog_cnt);

    unlock:
    mutex_unlock(&ir_raw_handler_lock);
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-06 14:11    [W:4.096 / U:0.804 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site