Daniel Borkmann 9975a54b3c bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_len ... bpf_prog_size(prog->len) is not the correct length we want to dump back to user space. The code in bpf_prog_get_info_by_fd() uses this to copy prog->insnsi to user space, but bpf_prog_size(prog->len) also includes the size of struct bpf_prog itself plus program instructions and is usually used either in context of accounting or for bpf_prog_alloc() et al, thus we copy out of bounds in bpf_prog_get_info_by_fd() potentially. Use the correct bpf_prog_insn_size() instead. Fixes: 1e27097690 ("bpf: Add BPF_OBJ_GET_INFO_BY_FD") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-07-29 23:29:41 -07:00
..
arraymap.c	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
bpf_lru_list.c
bpf_lru_list.h
cgroup.c	bpf: BPF support for sock_ops	2017-07-01 16:15:13 -07:00
core.c	bpf: Fix out-of-bound access on interpreters[]	2017-06-29 15:37:04 -04:00
hashtab.c	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
helpers.c
inode.c	bpf: Implement show_options	2017-07-06 03:31:46 -04:00
lpm_trie.c	bpf: fix wrong exposure of map_flags into fdinfo for lpm	2017-05-25 13:44:28 -04:00
Makefile
map_in_map.c	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
map_in_map.h	bpf: Add syscall lookup support for fd array and htab	2017-06-29 13:13:25 -04:00
percpu_freelist.c
percpu_freelist.h
stackmap.c	bpf: fix wrong exposure of map_flags into fdinfo for lpm	2017-05-25 13:44:28 -04:00
syscall.c	bpf: fix bpf_prog_get_info_by_fd to dump correct xlated_prog_len	2017-07-29 23:29:41 -07:00
verifier.c	bpf/verifier: fix min/max handling in BPF_SUB	2017-07-24 14:02:55 -07:00