diff options
| author | Yuntao Wang <[email protected]> | 2022-04-30 13:08:03 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <[email protected]> | 2022-05-12 04:24:20 +0000 |
| commit | a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d (patch) | |
| tree | 7fe531debdf3412e10287ed5d4745c6a6eafdd57 /tools/lib/bpf/bpf.c | |
| parent | selftests/bpf: make fexit_stress test run in serial mode (diff) | |
| download | kernel-a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d.tar.gz kernel-a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d.zip | |
bpf: Fix potential array overflow in bpf_trampoline_get_progs()
The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
can exceed BPF_MAX_TRAMP_PROGS.
When this happens, the assignment '*progs++ = aux->prog' in
bpf_trampoline_get_progs() will cause progs array overflow as the
progs field in the bpf_tramp_progs struct can only hold at most
BPF_MAX_TRAMP_PROGS bpf programs.
Fixes: 88fd9e5352fe ("bpf: Refactor trampoline update code")
Signed-off-by: Yuntao Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Alexei Starovoitov <[email protected]>
Diffstat (limited to 'tools/lib/bpf/bpf.c')
0 files changed, 0 insertions, 0 deletions