bpf: Zero queue and stack outputs on lock failure

Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call.

Kumar Kartikeya Dwivedi committed 3 months ago

Commit 7ac6e1a1 parent 5f30ac91 file · +6 −2Browse files

Showing the changes to kernel/bpf/queue_stack_maps.c (1 of 1 file). Show all

Unified · Split

kernel/bpf/queue_stack_maps.c+6−2

@@ -99,8 +99,10 @@ static long __queue_map_get(struct bpf_map map, void value, bool delete) · 98 unmodified lines
99	99	int err = 0;
100	100	void *ptr;
101	101
102		− if (raw_res_spin_lock_irqsave(&qs->lock, flags))
	102	+ if (raw_res_spin_lock_irqsave(&qs->lock, flags)) {
	103	+ memset(value, 0, qs->map.value_size);
103	104	return -EBUSY;
	105	+ }
104	106
105	107	if (queue_stack_map_is_empty(qs)) {
106	108	memset(value, 0, qs->map.value_size);
@@ -130,8 +132,10 @@ static long __stack_map_get(struct bpf_map map, void value, bool delete) · 23 unmodified lines
130	132	void *ptr;
131	133	u32 index;
132	134
133		− if (raw_res_spin_lock_irqsave(&qs->lock, flags))
	135	+ if (raw_res_spin_lock_irqsave(&qs->lock, flags)) {
	136	+ memset(value, 0, qs->map.value_size);
134	137	return -EBUSY;
	138	+ }
135	139
136	140	if (queue_stack_map_is_empty(qs)) {
137	141	memset(value, 0, qs->map.value_size);