diff options
| author | Christophe Leroy <christophe.leroy@csgroup.eu> | 2024-03-16 08:35:41 +0100 |
|---|---|---|
| committer | Martin KaFai Lau <martin.lau@kernel.org> | 2024-03-18 14:18:47 -0700 |
| commit | c733239f8f530872a1f80d8c45dcafbaff368737 (patch) | |
| tree | bd2fb53ca8a95c663a415f5b8a5479b338cfa7fd /kernel/bpf/bpf_struct_ops.c | |
| parent | e3362acd796789dc0562eb1a3937007b0beb0c5b (diff) | |
| download | linux-stable-c733239f8f530872a1f80d8c45dcafbaff368737.tar.gz linux-stable-c733239f8f530872a1f80d8c45dcafbaff368737.tar.bz2 linux-stable-c733239f8f530872a1f80d8c45dcafbaff368737.zip | |
bpf: Check return from set_memory_rox()
arch_protect_bpf_trampoline() and alloc_new_pack() call
set_memory_rox() which can fail, leading to unprotected memory.
Take into account return from set_memory_rox() function and add
__must_check flag to arch_protect_bpf_trampoline().
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/fe1c163c83767fde5cab31d209a4a6be3ddb3a73.1710574353.git.christophe.leroy@csgroup.eu
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Diffstat (limited to 'kernel/bpf/bpf_struct_ops.c')
| -rw-r--r-- | kernel/bpf/bpf_struct_ops.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c index 3fcd35314ce5..86c7884abaf8 100644 --- a/kernel/bpf/bpf_struct_ops.c +++ b/kernel/bpf/bpf_struct_ops.c @@ -740,8 +740,12 @@ static long bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, if (err) goto reset_unlock; } - for (i = 0; i < st_map->image_pages_cnt; i++) - arch_protect_bpf_trampoline(st_map->image_pages[i], PAGE_SIZE); + for (i = 0; i < st_map->image_pages_cnt; i++) { + err = arch_protect_bpf_trampoline(st_map->image_pages[i], + PAGE_SIZE); + if (err) + goto reset_unlock; + } if (st_map->map.map_flags & BPF_F_LINK) { err = 0; |