bpf: Fix off-by-one boundary validation in arena direct-value access#11956
bpf: Fix off-by-one boundary validation in arena direct-value access#11956kernel-patches-daemon-bpf[bot] wants to merge 1 commit intobpf_basefrom
Conversation
|
Upstream branch: b5c111f |
|
Upstream branch: b5c111f |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
d7b5438 to
92bf26e
Compare
kernel-patches-daemon-bpf
Bot
force-pushed
the
bpf_base
branch
from
5a2f726 to
0f927f5
Compare
|
Upstream branch: b5c111f |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
92bf26e to
edff994
Compare
kernel-patches-daemon-bpf
Bot
force-pushed
the
bpf_base
branch
from
0f927f5 to
16f0aff
Compare
|
Upstream branch: b5c111f |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
edff994 to
a6c6553
Compare
kernel-patches-daemon-bpf
Bot
force-pushed
the
bpf_base
branch
from
16f0aff to
ee9631b
Compare
|
Upstream branch: 0c7ae13 |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
a6c6553 to
ed8db58
Compare
kernel-patches-daemon-bpf
Bot
force-pushed
the
bpf_base
branch
from
ee9631b to
010a7e6
Compare
|
Upstream branch: f3b8c28 |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
ed8db58 to
91d33f8
Compare
kernel-patches-daemon-bpf
Bot
force-pushed
the
bpf_base
branch
from
010a7e6 to
c40937c
Compare
BPF_MAP_TYPE_ARENA accepts BPF_PSEUDO_MAP_VALUE offsets at exactly the end of the arena mapping (off == arena_size). The boundary check in arena_map_direct_value_addr() uses `>` instead of `>=`, which incorrectly allows a one-past-end pointer to be accepted. Change the condition to `>=` to correctly reject offsets that fall outside the valid arena user_vm range. Fixes: 3174603 ("bpf: Introduce bpf_arena.") Signed-off-by: Junyoung Jang <graypanda.inzag@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
|
Upstream branch: 18fc650 |
kernel-patches-daemon-bpf
Bot
force-pushed
the
series/1085694=>bpf
branch
from
91d33f8 to
72a150d
Compare
|
At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=1085694 irrelevant now. Closing PR. |
1 participant
Pull request for series with
subject: bpf: Fix off-by-one boundary validation in arena direct-value access
version: 2
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1085694