Commit 876bf652 authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Pu Lehui
Browse files

bpf: verifier: Use copy_array for jmp_history 

mainline inclusion
from mainline-v5.14-rc1
commit 06ab6a50
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VT
CVE: CVE-2023-52452

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=06ab6a505583



--------------------------------

Eliminate a couple needless kfree / kmalloc cycles by using
copy_array for jmp_history.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210429134656.122225-3-lmb@cloudflare.com


Signed-off-by: default avatarPu Lehui <pulehui@huawei.com>
parent e33dfe14

kernel/bpf/verifier.c

+5 −8
Original line number Diff line number Diff line
@@ -897,16 +897,13 @@ static int copy_verifier_state(struct bpf_verifier_state *dst_state, 
			       const struct bpf_verifier_state *src)

{

	struct bpf_func_state *dst;

	u32 jmp_sz = sizeof(struct bpf_idx_pair) * src->jmp_history_cnt;

	int i, err;



	if (dst_state->jmp_history_cnt < src->jmp_history_cnt) {

		kfree(dst_state->jmp_history);

		dst_state->jmp_history = kmalloc(jmp_sz, GFP_USER);

	dst_state->jmp_history = copy_array(dst_state->jmp_history, src->jmp_history,

					    src->jmp_history_cnt, sizeof(struct bpf_idx_pair),

					    GFP_USER);

	if (!dst_state->jmp_history)

		return -ENOMEM;

	}

	memcpy(dst_state->jmp_history, src->jmp_history, jmp_sz);

	dst_state->jmp_history_cnt = src->jmp_history_cnt;



	/* if dst has more stack frames then src frame, free them */