| Message ID | 20210122164232.61770-2-loris.reiff@liblor.ch (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f4a2da755a7e1f5d845c52aee71336cee289935a |
| Delegated to: | BPF |
| Headers | show |
| Series | [1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
On Fri, Jan 22, 2021 at 8:43 AM Loris Reiff <loris.reiff@liblor.ch> wrote: > > Since ctx.optlen is signed, a larger value than max_value could be > passed, as it is later on used as unsigned, which causes a WARN_ON_ONCE > in the copy_to_user. > > Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") > Signed-off-by: Loris Reiff <loris.reiff@liblor.ch> > --- > kernel/bpf/cgroup.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c > index 6ec8f02f4..6aa9e10c6 100644 > --- a/kernel/bpf/cgroup.c > +++ b/kernel/bpf/cgroup.c > @@ -1464,7 +1464,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, > goto out; > } > > - if (ctx.optlen > max_optlen) { > + if (ctx.optlen > max_optlen || ctx.optlen < 0) { > ret = -EFAULT; > goto out; > } > -- > 2.29.2 Thanks! I assume this is only an issue if the BPF program is written incorrectly. Reviewed-by: Stanislav Fomichev <sdf@google.com>
Excerpts from Stanislav Fomichev's message of January 22, 2021 18:04: > Thanks! I assume this is only an issue if the BPF program is written > incorrectly. Yes exactly.
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 6ec8f02f4..6aa9e10c6 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -1464,7 +1464,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, goto out; } - if (ctx.optlen > max_optlen) { + if (ctx.optlen > max_optlen || ctx.optlen < 0) { ret = -EFAULT; goto out; }
Since ctx.optlen is signed, a larger value than max_value could be passed, as it is later on used as unsigned, which causes a WARN_ON_ONCE in the copy_to_user. Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") Signed-off-by: Loris Reiff <loris.reiff@liblor.ch> --- kernel/bpf/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)