Daniel Borkmann d210f9735e bpf: Fix mprog detachment for empty mprog entry ... syzbot reported an UBSAN array-index-out-of-bounds access in bpf_mprog_read() upon bpf_mprog_detach(). While it did not have a reproducer, I was able to manually reproduce through an empty mprog entry which just has miniq present. The latter is important given otherwise we get an ENOENT error as tcx detaches the whole mprog entry. The index 4294967295 was triggered via NULL dtuple.prog which then attempts to detach from the back. bpf_mprog_fetch() in this case did hit the idx == total and therefore tried to grab the entry at idx -1. Fix it by adding an explicit bpf_mprog_total() check in bpf_mprog_detach() and bail out early with ENOENT. Fixes: 053c8e1f23 ("bpf: Add generic attach/detach/query API for multi-progs") Reported-by: syzbot+0c06ba0f831fe07a8f27@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/r/20230804131112.11012-1-daniel@iogearbox.net Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>		2023-08-04 09:35:39 -07:00
..
preload	bpf: make preloaded map iterators to display map elements count	2023-07-06 12:42:25 -07:00
arraymap.c	bpf: return long from bpf_map_ops funcs	2023-03-22 15:11:30 -07:00
bloom_filter.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
bpf_cgrp_storage.c	bpf: Teach verifier that certain helpers accept NULL pointer.	2023-04-04 16:57:16 -07:00
bpf_inode_storage.c	Networking changes for 6.4.	2023-04-26 16:07:23 -07:00
bpf_iter.c	bpf: implement numbers iterator	2023-03-08 16:19:51 -08:00
bpf_local_storage.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
bpf_lru_list.c	bpf: Address KCSAN report on bpf_lru_list	2023-05-12 12:01:03 -07:00
bpf_lru_list.h	bpf: Address KCSAN report on bpf_lru_list	2023-05-12 12:01:03 -07:00
bpf_lsm.c	bpf: Fix the kernel crash caused by bpf_setsockopt().	2023-01-26 23:26:40 -08:00
bpf_struct_ops.c	bpf: bpf_struct_ops: Remove unnecessary initial values of variables	2023-08-03 17:54:35 -07:00
bpf_struct_ops_types.h	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpf_task_storage.c	bpf: Teach verifier that certain helpers accept NULL pointer.	2023-04-04 16:57:16 -07:00
btf.c	net: invert the netdevice.h vs xdp.h dependency	2023-08-03 08:38:07 -07:00
cgroup.c	bpf-next-for-netdev	2023-05-16 19:50:05 -07:00
cgroup_iter.c	cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers	2023-03-17 12:07:13 -10:00
core.c	bpf: fix bpf_probe_read_kernel prototype mismatch	2023-08-02 14:14:17 -07:00
cpumap.c	pull-request: bpf-next 2023-08-03	2023-08-03 15:34:36 -07:00
cpumask.c	bpf: Convert bpf_cpumask to bpf_mem_cache_free_rcu.	2023-07-12 23:45:23 +02:00
devmap.c	bpf, devmap: Remove unused dtab field from bpf_dtab_netdev	2023-07-31 18:26:08 -07:00
disasm.c	bpf: Fix an array-index-out-of-bounds issue in disasm.c	2023-07-31 17:35:02 -07:00
disasm.h
dispatcher.c	bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func	2022-12-14 12:02:14 -08:00
hashtab.c	bpf: populate the per-cpu insertions/deletions counters for hashmaps	2023-07-06 12:42:25 -07:00
helpers.c	bpf, net: Introduce skb_pointer_if_linear().	2023-07-19 10:27:33 -07:00
inode.c	bpf: Support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands	2023-05-23 23:31:42 +02:00
Kconfig	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	cgroup changes for v6.4-rc1	2023-04-29 10:05:22 -07:00
log.c	bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log	2023-05-16 22:34:50 -07:00
lpm_trie.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
Makefile	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
map_in_map.c	bpf: Fix elem_size not being set for inner maps	2023-06-02 16:22:12 -07:00
map_in_map.h
map_iter.c	bpf: allow any program to use the bpf_map_sum_elem_count kfunc	2023-07-19 09:48:53 -07:00
memalloc.c	bpf: Non-atomically allocate freelist during prefill	2023-07-28 09:41:10 -07:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
mprog.c	bpf: Fix mprog detachment for empty mprog entry	2023-08-04 09:35:39 -07:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	net: invert the netdevice.h vs xdp.h dependency	2023-08-03 08:38:07 -07:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-11 12:05:14 -08:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
reuseport_array.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
ringbuf.c	bpf: Remove unnecessary ring buffer size check	2023-07-05 14:09:45 +02:00
stackmap.c	bpf: Centralize permissions checks for all BPF map types	2023-06-19 14:04:04 +02:00
syscall.c	bpf: Add fd-based tcx multi-prog infra with link support	2023-07-19 10:07:27 -07:00
sysfs_btf.c
task_iter.c	bpf: keep a reference to the mm, in case the task is dead.	2022-12-28 14:11:48 -08:00
tcx.c	tcx: Fix splat during dev unregister	2023-07-31 14:44:02 -07:00
tnum.c
trampoline.c	bpf: Fix memleak due to fentry attach failure	2023-05-15 23:41:59 +02:00
verifier.c	net: invert the netdevice.h vs xdp.h dependency	2023-08-03 08:38:07 -07:00