Pull networking fixes from David Miller: "Several smallish fixes, I don't think any of this requires another -rc but I'll leave that up to you: 1) Don't leak uninitialzed bytes to userspace in xfrm_user, from Eric Dumazet. 2) Route leak in xfrm_lookup_route(), from Tommi Rantala. 3) Premature poll() returns in AF_XDP, from Björn Töpel. 4) devlink leak in netdevsim, from Jakub Kicinski. 5) Don't BUG_ON in fib_compute_spec_dst, the condition can legitimately happen. From Lorenzo Bianconi. 6) Fix some spectre v1 gadgets in generic socket code, from Jeremy Cline. 7) Don't allow user to bind to out of range multicast groups, from Dmitry Safonov with a follow-up by Dmitry Safonov. 8) Fix metrics leak in fib6_drop_pcpu_from(), from Sabrina Dubroca" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits) netlink: Don't shift with UB on nlk->ngroups net/ipv6: fix metrics leak xen-netfront: wait xenbus state change when load module manually can: ems_usb: Fix memory leak on ems_usb_disconnect() openvswitch: meter: Fix setting meter id for new entries netlink: Do not subscribe to non-existent groups NET: stmmac: align DMA stuff to largest cache line length tcp_bbr: fix bw probing to raise in-flight data for very small BDPs net: socket: Fix potential spectre v1 gadget in sock_is_registered net: socket: fix potential spectre v1 gadget in socketcall net: mdio-mux: bcm-iproc: fix wrong getter and setter pair ipv4: remove BUG_ON() from fib_compute_spec_dst enic: handle mtu change for vf properly net: lan78xx: fix rx handling before first packet is send nfp: flower: fix port metadata conversion bug bpf: use GFP_ATOMIC instead of GFP_KERNEL in bpf_parse_prog() bpf: fix bpf_skb_load_bytes_relative pkt length check perf build: Build error in libbpf missing initialization net: ena: Fix use of uninitialized DMA address bits field bpf: btf: Use exact btf value_size match in map_check_btf() ...
Showing the changes to kernel (2 of 47 files). Show all
Unified · Split
| @@ -378,7 +378,7 @@ static int array_map_check_btf(const struct bpf_map *map, const struct btf *btf, · 377 unmodified lines | ||
| 378 | 378 | return -EINVAL; |
| 379 | 379 | |
| 380 | 380 | value_type = btf_type_id_size(btf, &btf_value_id, &value_size); |
| 381 | − if (!value_type || value_size > map->value_size) | |
| 381 | + if (!value_type || value_size != map->value_size) | |
| 382 | 382 | return -EINVAL; |
| 383 | 383 | |
| 384 | 384 | return 0; |
| @@ -1519,9 +1519,9 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, · 1518 unmodified lines | ||
| 1519 | 1519 | { |
| 1520 | 1520 | bool is_union = BTF_INFO_KIND(t->info) == BTF_KIND_UNION; |
| 1521 | 1521 | const struct btf_member *member; |
| 1522 | + u32 meta_needed, last_offset; | |
| 1522 | 1523 | struct btf *btf = env->btf; |
| 1523 | 1524 | u32 struct_size = t->size; |
| 1524 | − u32 meta_needed; | |
| 1525 | 1525 | u16 i; |
| 1526 | 1526 | |
| 1527 | 1527 | meta_needed = btf_type_vlen(t) * sizeof(*member); |
| @@ -1534,6 +1534,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, · 6 unmodified lines | ||
| 1534 | 1534 | |
| 1535 | 1535 | btf_verifier_log_type(env, t, NULL); |
| 1536 | 1536 | |
| 1537 | + last_offset = 0; | |
| 1537 | 1538 | for_each_member(i, t, member) { |
| 1538 | 1539 | if (!btf_name_offset_valid(btf, member->name_off)) { |
| 1539 | 1540 | btf_verifier_log_member(env, t, member, |
| @@ -1555,6 +1556,16 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, · 15 unmodified lines | ||
| 1555 | 1556 | return -EINVAL; |
| 1556 | 1557 | } |
| 1557 | 1558 | |
| 1559 | + /* | |
| 1560 | + * ">" instead of ">=" because the last member could be | |
| 1561 | + * "char a[0];" | |
| 1562 | + */ | |
| 1563 | + if (last_offset > member->offset) { | |
| 1564 | + btf_verifier_log_member(env, t, member, | |
| 1565 | + "Invalid member bits_offset"); | |
| 1566 | + return -EINVAL; | |
| 1567 | + } | |
| 1568 | + | |
| 1558 | 1569 | if (BITS_ROUNDUP_BYTES(member->offset) > struct_size) { |
| 1559 | 1570 | btf_verifier_log_member(env, t, member, |
| 1560 | 1571 | "Memmber bits_offset exceeds its struct size"); |
| @@ -1562,6 +1573,7 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, · 1 unmodified line | ||
| 1562 | 1573 | } |
| 1563 | 1574 | |
| 1564 | 1575 | btf_verifier_log_member(env, t, member, NULL); |
| 1576 | + last_offset = member->offset; | |
| 1565 | 1577 | } |
| 1566 | 1578 | |
| 1567 | 1579 | return meta_needed; |