Xu Kuohai be006212bd bpf: Do not copy spin lock field from user in bpf_selem_alloc ... [ Upstream commit 836e49e103dfeeff670c934b7d563cbd982fce87 ] bpf_selem_alloc function is used by inode_storage, sk_storage and task_storage maps to set map value, for these map types, there may be a spin lock in the map value, so if we use memcpy to copy the whole map value from user, the spin lock field may be initialized incorrectly. Since the spin lock field is zeroed by kzalloc, call copy_map_value instead of memcpy to skip copying the spin lock field to fix it. Fixes: 6ac99e8f23 ("bpf: Introduce bpf sk local storage") Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/r/20221114134720.1057939-2-xukuohai@huawei.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-12-08 11:23:55 +01:00
..
preload	bpf: Fix umd memory leak in copy_process()	2021-03-30 14:32:03 +02:00
arraymap.c	bpf: Acquire map uref in .init_seq_private for array map iterator	2022-08-25 11:37:55 +02:00
bpf_inode_storage.c	bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF	2021-03-30 14:31:56 +02:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-03-04 11:37:33 +01:00
bpf_local_storage.c	bpf: Do not copy spin lock field from user in bpf_selem_alloc	2022-12-08 11:23:55 +01:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 11:37:29 +01:00
bpf_lru_list.h	bpf: Fix a typo "inacitve" -> "inactive"	2020-04-06 21:54:10 +02:00
bpf_lsm.c	bpf: Update verification logic for LSM programs	2020-11-06 13:15:21 -08:00
bpf_struct_ops_types.h	bpf: tcp: Support tcp_congestion_ops in bpf	2020-01-09 08:46:18 -08:00
bpf_struct_ops.c	bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog	2021-10-06 15:55:50 +02:00
btf.c	bpf: btf: fix truncated last_member_type_id in btf_struct_resolve	2022-10-26 13:25:20 +02:00
cgroup.c	bpf, cgroup: Fix kernel BUG in purge_effective_progs	2022-09-08 11:11:36 +02:00
core.c	bpf: Make sure mac_header was set before using it	2022-07-29 17:19:23 +02:00
cpumap.c	bpf, cpumap: Remove rcpu pointer from cpu_map_build_skb signature	2020-09-28 23:30:42 +02:00
devmap.c	bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc	2021-12-17 10:14:41 +01:00
disasm.c	bpf: Introduce BPF nospec instruction for mitigating Spectre v4	2021-08-04 12:46:44 +02:00
disasm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
dispatcher.c	bpf: Remove bpf_image tree	2020-03-13 12:49:52 -07:00
hashtab.c	bpf: Acquire map uref in .init_seq_private for hash map iterator	2022-08-25 11:37:55 +02:00
helpers.c	bpf: Fix potentially incorrect results with bpf_get_local_storage()	2021-09-03 10:09:31 +02:00
inode.c	bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET	2021-04-14 08:42:00 +02:00
local_storage.c	bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper	2021-09-03 10:09:21 +02:00
lpm_trie.c	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-10-29 20:01:46 -07:00
map_in_map.c	bpf: Relax max_entries check for most of the inner map types	2020-08-28 15:41:30 +02:00
map_in_map.h	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
map_iter.c	bpf: Implement link_query callbacks in map element iterators	2020-08-21 14:01:39 -07:00
net_namespace.c	bpf: Add support for forced LINK_DETACH command	2020-08-01 20:38:28 -07:00
offload.c	bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill	2020-02-17 16:53:49 +01:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-25 17:45:45 +01:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
reuseport_array.c	bpf, net: Rework cookie generator as per-cpu one	2020-09-30 11:50:35 -07:00
ringbuf.c	bpf: Use VM_MAP instead of VM_ALLOC for ringbuf	2022-02-08 18:30:39 +01:00
stackmap.c	bpf: Fix incorrect memory charge cost calculation in stack_map_alloc()	2022-06-22 14:13:12 +02:00
syscall.c	bpf: Ensure correct locking around vulnerable function find_vpid()	2022-10-26 13:25:21 +02:00
sysfs_btf.c	bpf: Fix sysfs export of empty BTF section	2020-09-21 21:50:24 +02:00
task_iter.c	bpf: Save correct stopping point in file seq iteration	2021-01-19 18:27:28 +01:00
tnum.c	bpf: Verifier, do explicit ALU32 bounds tracking	2020-03-30 14:59:53 -07:00
trampoline.c	bpf: Fix potential array overflow in bpf_trampoline_get_progs()	2022-06-06 08:42:45 +02:00
verifier.c	bpf: Fix wrong reg type conversion in release_reference()	2022-11-16 09:57:09 +01:00