History

bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Kumar Kartikeya Dwivedi committed 3 months ago

Commit 7ac6e1a1 parent 5f30ac91 file · +6 −2Browse files

Showing the changes to kernel/bpf/queue_stack_maps.c (1 of 1 file). Show all

Unified · Split

kernel/bpf/queue_stack_maps.c+6−2
@@ -99,8 +99,10 @@ static long __queue_map_get(struct bpf_map *map, void *value, bool delete) · 98 unmodified lines
99 int err = 0;99 int err = 0;
100 void *ptr;100 void *ptr;
101 101
102 if (raw_res_spin_lock_irqsave(&qs->lock, flags))102 if (raw_res_spin_lock_irqsave(&qs->lock, flags)) {
103 memset(value, 0, qs->map.value_size);
103 return -EBUSY;104 return -EBUSY;
105 }
104 106
105 if (queue_stack_map_is_empty(qs)) {107 if (queue_stack_map_is_empty(qs)) {
106 memset(value, 0, qs->map.value_size);108 memset(value, 0, qs->map.value_size);
@@ -130,8 +132,10 @@ static long __stack_map_get(struct bpf_map *map, void *value, bool delete) · 23 unmodified lines
130 void *ptr;132 void *ptr;
131 u32 index;133 u32 index;
132 134
133 if (raw_res_spin_lock_irqsave(&qs->lock, flags))135 if (raw_res_spin_lock_irqsave(&qs->lock, flags)) {
136 memset(value, 0, qs->map.value_size);
134 return -EBUSY;137 return -EBUSY;
138 }
135 139
136 if (queue_stack_map_is_empty(qs)) {140 if (queue_stack_map_is_empty(qs)) {
137 memset(value, 0, qs->map.value_size);141 memset(value, 0, qs->map.value_size);