Martin Lau 54299e1cf3 bpf, btf: fix a missing check bug in btf_parse ... [ Upstream commit 4a6998aff8 ] Wenwen Wang reported: In btf_parse(), the header of the user-space btf data 'btf_data' is firstly parsed and verified through btf_parse_hdr(). In btf_parse_hdr(), the header is copied from user-space 'btf_data' to kernel-space 'btf->hdr' and then verified. If no error happens during the verification process, the whole data of 'btf_data', including the header, is then copied to 'data' in btf_parse(). It is obvious that the header is copied twice here. More importantly, no check is enforced after the second copy to make sure the headers obtained in these two copies are same. Given that 'btf_data' resides in the user space, a malicious user can race to modify the header between these two copies. By doing so, the user can inject inconsistent data, which can cause undefined behavior of the kernel and introduce potential security risk. This issue is similar to the one fixed in commit 8af03d1ae2 ("bpf: btf: Fix a missing check bug"). To fix it, this patch copies the user 'btf_data' *before* parsing / verifying the BTF header. Fixes: 69b693f0ae ("bpf: btf: Introduce BPF Type Format (BTF)") Signed-off-by: Martin KaFai Lau <kafai@fb.com> Co-developed-by: Wenwen Wang <wang6495@umn.edu> Acked-by: Song Liu <songliubraving@fb.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-12-01 09:17:01 +01:00
..
bpf	bpf, btf: fix a missing check bug in btf_parse	2019-12-01 09:17:01 +01:00
cgroup	cgroup: Fix css_task_iter_advance_css_set() cset skip condition	2019-08-09 17:52:35 +02:00
configs	kconfig: tinyconfig: remove stale stack protector fixups	2018-06-15 07:15:28 +09:00
debug	kdb: Don't back trace on a cpu that didn't round up	2019-02-12 19:47:19 +01:00
dma	swiotlb: do not panic on mapping failures	2019-12-01 09:16:42 +01:00
events	signal: Properly deliver SIGILL from uprobes	2019-11-20 18:46:22 +01:00
gcov
irq	genirq: Prevent NULL pointer dereference in resend_irqs()	2019-09-19 09:09:34 +02:00
livepatch	livepatch: Nullify obj->mod in klp_module_coming()'s error path	2019-10-07 18:57:10 +02:00
locking	Revert "locking/pvqspinlock: Don't wait if vCPU is preempted"	2019-10-11 18:21:06 +02:00
power	x86/power: Fix 'nosmt' vs hibernation triple fault during resume	2019-06-11 12:20:52 +02:00
printk	printk: fix integer overflow in setup_log_buf()	2019-12-01 09:16:14 +01:00
rcu	rcuperf: Fix cleanup path for invalid perf_type strings	2019-05-31 06:46:30 -07:00
sched	sched/debug: Explicitly cast sched_feat() to bool	2019-11-20 18:46:13 +01:00
time	y2038: make do_gettimeofday() and get_seconds() inline	2019-11-20 18:45:24 +01:00
trace	tracing: Fix "gfp_t" format for synthetic events	2019-11-10 11:27:28 +01:00
.gitignore
acct.c	acct_on(): don't mess with freeze protection	2019-05-31 06:46:05 -07:00
async.c
audit.c	audit: use ktime_get_coarse_real_ts64() for timestamps	2018-07-17 14:45:08 -04:00
audit.h
audit_fsnotify.c
audit_tree.c	\n	2018-08-17 09:41:28 -07:00
audit_watch.c	audit: fix use-after-free in audit_add_watch	2018-07-18 11:43:36 -04:00
auditfilter.c	audit: fix a memory leak bug	2019-05-31 06:46:17 -07:00
auditsc.c	audit/stable-4.18 PR 20180814	2018-08-15 10:46:54 -07:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-13 11:08:47 -08:00
capability.c
compat.c	time: Enable get/put_compat_itimerspec64 always	2018-06-24 14:39:47 +02:00
configs.c
context_tracking.c
cpu.c	cpu/SMT: State SMT is disabled even with nosmt and without "=force"	2019-11-24 08:20:18 +01:00
cpu_pm.c
crash_core.c	kernel/crash_core.c: print timestamp using time64_t	2018-08-22 10:52:47 -07:00
crash_dump.c
cred.c	access: avoid the RCU grace period for the temporary subjective credentials	2019-07-31 07:27:11 +02:00
delayacct.c
dma.c
elfcore.c	kernel/elfcore.c: include proper prototypes	2019-10-11 18:21:23 +02:00
exec_domain.c
exit.c	cgroup: Call cgroup_release() before __exit_signal()	2019-08-09 17:52:34 +02:00
extable.c
fail_function.c	bpf/error-inject/kprobes: Clear current_kprobe and enable preempt in kprobe	2018-06-21 12:33:19 +02:00
fork.c	kernel/sysctl.c: do not override max_threads provided by userspace	2019-10-17 13:45:19 -07:00
freezer.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
futex.c	locking/futex: Allow low-level atomic operations to return -EAGAIN	2019-05-10 17:54:11 +02:00
futex_compat.c
groups.c
hung_task.c	kernel: hung_task.c: disable on suspend	2019-04-20 09:16:02 +02:00
iomem.c
irq_work.c	irq_work: Do not raise an IPI when queueing work on the local CPU	2019-05-31 06:46:19 -07:00
jump_label.c	jump_label: move 'asm goto' support test to Kconfig	2019-06-04 08:02:34 +02:00
kallsyms.c	kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol	2019-09-21 07:17:02 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	kconfig: include kernel/Kconfig.preempt from init/Kconfig	2018-08-02 08:06:54 +09:00
kcov.c	kernel/kcov.c: mark write_comp_data() as notrace	2019-02-12 19:47:20 +01:00
kexec.c	kexec: add call to LSM hook in original kexec_load syscall	2018-07-16 12:31:57 -07:00
kexec_core.c	kexec: Allocate decrypted control pages for kdump if SME is enabled	2019-11-24 08:20:29 +01:00
kexec_file.c	treewide: Use array_size() in vzalloc()	2018-06-12 16:19:22 -07:00
kexec_internal.h
kmod.c
kprobes.c	kprobes: Don't call BUG_ON() if there is a kprobe in use on free list	2019-11-20 18:46:30 +01:00
ksysfs.c
kthread.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
latencytop.c
Makefile	x86/uaccess, kcov: Disable stack protector	2019-06-19 08:18:01 +02:00
memremap.c	mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support	2019-01-13 09:51:04 +01:00
module-internal.h	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
module.c	modules: fix compile error if don't have strict module rwx	2019-09-19 09:09:40 +02:00
module_signing.c	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
notifier.c
nsproxy.c
padata.c	padata: use smp_mb in padata_reorder to avoid orphaned padata jobs	2019-07-26 09:14:25 +02:00
panic.c	panic: ensure preemption is disabled during panic()	2019-10-17 13:44:46 -07:00
params.c
pid.c	Fix failure path in alloc_pid()	2019-01-13 09:51:06 +01:00
pid_namespace.c	signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig	2019-07-26 09:14:01 +02:00
profile.c
ptrace.c	ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME	2019-07-10 09:53:41 +02:00
range.c
reboot.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
relay.c	relay: check return of create_buf_file() properly	2019-03-13 14:02:35 -07:00
resource.c	resource: fix locking in find_next_iomem_res()	2019-09-16 08:22:20 +02:00
rseq.c	rseq: uapi: Declare rseq_cs field as union, update includes	2018-07-10 22:18:52 +02:00
seccomp.c
signal.c	signal: Always ignore SIGKILL and SIGSTOP sent to the global init	2019-11-20 18:46:21 +01:00
smp.c	cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM	2019-02-12 19:47:25 +01:00
smpboot.c	smpboot: Remove cpumask from the API	2018-07-03 09:20:44 +02:00
smpboot.h
softirq.c	nohz: Fix missing tick reprogram when interrupting an inline softirq	2018-08-03 15:52:10 +02:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sys.c	kernel/sys.c: prctl: fix false positive in validate_prctl_map()	2019-06-15 11:54:01 +02:00
sys_ni.c	Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-06-10 10:17:09 -07:00
sysctl.c	sysctl: return -EINVAL if val violates minmax	2019-06-15 11:53:59 +02:00
sysctl_binary.c
task_work.c
taskstats.c
test_kprobes.c	kprobes: Remove jprobe API implementation	2018-06-21 12:33:05 +02:00
torture.c	torture: Keep old-school dmesg format	2018-06-25 11:30:10 -07:00
tracepoint.c	tracepoint: Fix tracepoint array element size mismatch	2018-10-17 15:35:29 -04:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c	userns: use irqsave variant of refcount_dec_and_lock()	2018-08-22 10:52:47 -07:00
user_namespace.c	userns: also map extents in the reverse map to kernel IDs	2018-11-13 11:09:00 -08:00
utsname.c
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-08-11 02:05:53 -05:00
watchdog.c	watchdog: Respect watchdog cpumask on CPU hotplug	2019-04-03 06:26:29 +02:00
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-08-30 12:56:40 +02:00
workqueue.c	workqueue: Try to catch flush_work() without INIT_WORK().	2019-05-02 09:58:56 +02:00
workqueue_internal.h