Yonghong Song 17d8beda27 bpf: Fix an unitialized value in bpf_iter ... Commit 15d83c4d7c ("bpf: Allow loading of a bpf_iter program") cached btf_id in struct bpf_iter_target_info so later on if it can be checked cheaply compared to checking registered names. syzbot found a bug that uninitialized value may occur to bpf_iter_target_info->btf_id. This is because we allocated bpf_iter_target_info structure with kmalloc and never initialized field btf_id afterwards. This uninitialized btf_id is typically compared to a u32 bpf program func proto btf_id, and the chance of being equal is extremely slim. This patch fixed the issue by using kzalloc which will also prevent future likely instances due to adding new fields. Fixes: 15d83c4d7c ("bpf: Allow loading of a bpf_iter program") Reported-by: syzbot+580f4f2a272e452d55cb@syzkaller.appspotmail.com Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20210212005926.2875002-1-yhs@fb.com		2021-02-12 13:33:50 -08:00
..
preload	bpf: Remove unnecessary <argp.h> include from preload/iterators	2021-01-08 13:39:24 -08:00
arraymap.c	bpf: Eliminate rlimit-based memory accounting for arraymap maps	2020-12-02 18:32:46 -08:00
bpf_inode_storage.c	bpf: Fix typo in bpf_inode_storage.c	2021-01-12 16:07:57 +01:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-02-12 13:33:50 -08:00
bpf_local_storage.c	bpf: Eliminate rlimit-based memory accounting for bpf local storage maps	2020-12-02 18:32:47 -08:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-02-10 15:54:26 -08:00
bpf_lru_list.h	bpf: Fix a typo "inacitve" -> "inactive"	2020-04-06 21:54:10 +02:00
bpf_lsm.c	bpf: Add a BPF helper for getting the IMA hash of an inode	2020-11-26 00:04:04 +01:00
bpf_struct_ops.c	bpf: Eliminate rlimit-based memory accounting for bpf_struct_ops maps	2020-12-02 18:32:46 -08:00
bpf_struct_ops_types.h	bpf: tcp: Support tcp_congestion_ops in bpf	2020-01-09 08:46:18 -08:00
bpf_task_storage.c	bpf: Local storage helpers should check nullness of owner ptr passed	2021-01-12 16:07:56 +01:00
btf.c	bpf: Permit size-0 datasec	2021-01-20 14:14:09 -08:00
cgroup.c	bpf: Allow rewriting to ports under ip_unprivileged_port_start	2021-01-27 18:18:15 -08:00
core.c	bpf: Clear per_cpu pointers during bpf_prog_realloc	2021-02-11 19:35:00 -08:00
cpumap.c	net, xdp: Introduce __xdp_build_skb_from_frame utility routine	2021-01-20 14:10:35 -08:00
devmap.c	bpf: Eliminate rlimit-based memory accounting for devmap maps	2020-12-02 18:32:46 -08:00
disasm.c	bpf: Change 'BPF_ADD' to 'BPF_AND' in print_bpf_insn()	2021-01-27 22:23:46 +01:00
disasm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
dispatcher.c	bpf: Remove bpf_image tree	2020-03-13 12:49:52 -07:00
hashtab.c	bpf: Allows per-cpu maps and map-in-map in sleepable programs	2021-02-11 16:19:26 +01:00
helpers.c	bpf: Simplify cases in bpf_base_func_proto	2021-01-29 02:20:28 +01:00
inode.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-09-22 16:45:34 -07:00
local_storage.c	bpf: Eliminate rlimit-based memory accounting for cgroup storage maps	2020-12-02 18:32:46 -08:00
lpm_trie.c	bpf: Eliminate rlimit-based memory accounting for lpm_trie maps	2020-12-02 18:32:46 -08:00
Makefile	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-11-14 09:13:41 -08:00
map_in_map.c	bpf: Relax max_entries check for most of the inner map types	2020-08-28 15:41:30 +02:00
map_in_map.h	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
map_iter.c	bpf: Implement link_query callbacks in map element iterators	2020-08-21 14:01:39 -07:00
net_namespace.c	bpf: Add support for forced LINK_DETACH command	2020-08-01 20:38:28 -07:00
offload.c	bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill	2020-02-17 16:53:49 +01:00
percpu_freelist.c	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps	2020-12-02 18:32:46 -08:00
reuseport_array.c	bpf: Eliminate rlimit-based memory accounting for reuseport_array maps	2020-12-02 18:32:47 -08:00
ringbuf.c	bpf: Eliminate rlimit-based memory accounting for bpf ringbuffer	2020-12-02 18:32:47 -08:00
stackmap.c	bpf: Add size arg to build_id_parse function	2021-01-14 19:29:58 -08:00
syscall.c	bpf: Count the number of times recursion was prevented	2021-02-11 16:19:20 +01:00
sysfs_btf.c	bpf: Load and verify kernel module BTFs	2020-11-10 15:25:53 -08:00
task_iter.c	bpf: Introduce task_vma bpf_iter	2021-02-12 12:56:53 -08:00
tnum.c	bpf: Verifier, do explicit ALU32 bounds tracking	2020-03-30 14:59:53 -07:00
trampoline.c	bpf: Count the number of times recursion was prevented	2021-02-11 16:19:20 +01:00
verifier.c	bpf: Fix subreg optimization for BPF_FETCH	2021-02-11 22:03:19 -08:00