Message ID | 20181024200549.8516-7-daniel@iogearbox.net |
---|---|
State | Accepted, archived |
Delegated to: | BPF Maintainers |
Headers | show |
Series | Batch of direct packet access fixes for BPF | expand |
On 10/24/18 3:05 PM, Daniel Borkmann wrote: > Commit f1a2e44a3aec ("bpf: add queue and stack maps") added helpers > with ARG_PTR_TO_UNINIT_MAP_VALUE. Meaning, the helper is supposed to > fill the map value buffer with data instead of reading from it like > in other helpers such as map update. However, given the buffer is > allowed to be uninitialized (since we fill it in the helper anyway), > it also means that the helper is obliged to wipe the memory in case > of an error in order to not allow for leaking uninitialized memory. > Given pop/peek is both handled inside __{stack,queue}_map_get(), > lets wipe it there on error case, that is, empty stack/queue. > > Fixes: f1a2e44a3aec ("bpf: add queue and stack maps") > Signed-off-by: Daniel Borkmann<daniel@iogearbox.net> > Acked-by: Alexei Starovoitov<ast@kernel.org> > Cc: Mauricio Vasquez B<mauricio.vasquez@polito.it> Thanks for the fix Daniel. Acked-by: Mauricio Vasquez B<mauricio.vasquez@polito.it>
diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c index 12a93fb..8bbd72d 100644 --- a/kernel/bpf/queue_stack_maps.c +++ b/kernel/bpf/queue_stack_maps.c @@ -122,6 +122,7 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete) raw_spin_lock_irqsave(&qs->lock, flags); if (queue_stack_map_is_empty(qs)) { + memset(value, 0, qs->map.value_size); err = -ENOENT; goto out; } @@ -151,6 +152,7 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete) raw_spin_lock_irqsave(&qs->lock, flags); if (queue_stack_map_is_empty(qs)) { + memset(value, 0, qs->map.value_size); err = -ENOENT; goto out; }