Commit 530e214c authored Feb 28, 2022 by Stanislav Fomichev Committed by Daniel Borkmann Mar 02, 2022

bpf, test_run: Fix overflow in XDP frags bpf_test_finish



Syzkaller reports another issue:

WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
check_copy_size include/linux/thread_info.h:230 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
copy_to_user include/linux/uaccess.h:199 [inline]
WARNING: CPU: 0 PID: 10775 at include/linux/thread_info.h:230
bpf_test_finish.isra.0+0x4b2/0x680 net/bpf/test_run.c:171

This can happen when the userspace buffer is smaller than head + frags.
Return ENOSPC in this case.

Fixes: 7855e0db ("bpf: test_run: add xdp_shared_info pointer in bpf_test_finish signature")
Reported-by:  <syzbot+5f81df6205ecbbc56ab5@syzkaller.appspotmail.com>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/bpf/20220228232332.458871-1-sdf@google.com

parent bd004cad

net/bpf/test_run.c

+5 −0

Original line number	Original line	Diff line number	Diff line
	@@ -150,6 +150,11 @@ static int bpf_test_finish(const union bpf_attr *kattr,
	if (data_out) {		if (data_out) {
	int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size;		int len = sinfo ? copy_size - sinfo->xdp_frags_size : copy_size;

			if (len < 0) {
			err = -ENOSPC;
			goto out;
			}

	if (copy_to_user(data_out, data, len))		if (copy_to_user(data_out, data, len))
	goto out;		goto out;