imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-28 12:53:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Check params size before reading reserved fields

Browse Source 
bpf_crypto_ctx_create() is a kfunc whose second argument is declared
with the __sz annotation, so the verifier only guarantees that
params__sz bytes of params are valid.  The function nevertheless reads
params->reserved[0] and params->reserved[1] (offsets 14 and 15) before
comparing params__sz against the size of struct bpf_crypto_params, so a
BPF program can pass a shorter buffer and have the kernel read past the
region that was validated for it.

Move the size check in front of the reserved field reads.

Fixes: 3e1c6f3540 ("bpf: make common crypto API for TC/XDP programs")
Reported-by: Vega <[email protected]>
Signed-off-by: Yuqi Xu <[email protected]>
Signed-off-by: Alexei Starovoitov <[email protected]>
Reviewed-by: Ren Wei <[email protected]>
Link: https://patch.msgid.link/4f3ab4b03e79017e215521743996555439bf0bb3.1789802413.git.xuyuqiabc@gmail.com
This commit is contained in:
Yuqi Xu authored and Alexei Starovoitov committed 2026-09-19 23:25:17 +00:00
1 parent e3b6cb020e
commit a11212910c
1 file changed
+3 -2
Download Patch File Download Diff File Expand all files Collapse all files
kernel/bpf/crypto.c
+3 -2
View File
@@ -149,8 +149,9 @@ bpf_crypto_ctx_create(const struct bpf_crypto_params *params, u32 params__sz,
const struct bpf_crypto_type *type;
struct bpf_crypto_ctx *ctx;
if (!params || params->reserved[0] || params->reserved[1] ||
params__sz != sizeof(struct bpf_crypto_params)) {
if (!params ||
params__sz != sizeof(struct bpf_crypto_params) ||
params->reserved[0] || params->reserved[1]) {
*err = -EINVAL;
return NULL;
}