提交 836e49e1 编写于 作者: X Xu Kuohai 提交者: Alexei Starovoitov

bpf: Do not copy spin lock field from user in bpf_selem_alloc

bpf_selem_alloc function is used by inode_storage, sk_storage and
task_storage maps to set map value, for these map types, there may
be a spin lock in the map value, so if we use memcpy to copy the whole
map value from user, the spin lock field may be initialized incorrectly.

Since the spin lock field is zeroed by kzalloc, call copy_map_value
instead of memcpy to skip copying the spin lock field to fix it.

Fixes: 6ac99e8f ("bpf: Introduce bpf sk local storage")
Signed-off-by: NXu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20221114134720.1057939-2-xukuohai@huawei.comSigned-off-by: NAlexei Starovoitov <ast@kernel.org>
上级 6f04180c
......@@ -74,7 +74,7 @@ bpf_selem_alloc(struct bpf_local_storage_map *smap, void *owner,
gfp_flags | __GFP_NOWARN);
if (selem) {
if (value)
memcpy(SDATA(selem)->data, value, smap->map.value_size);
copy_map_value(&smap->map, SDATA(selem)->data, value);
return selem;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册